Verify a decision

{"actor":"system:backfill","investigation_id":"255371db-55cc-4c52-9538-13b49927f4ef","kind":"publish","page_slug":"audia6-crypto-laundering-network","published_at":"2026-09-01T23:53:10.134Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"AudiA6 Crypto Laundering Network","sections":[{"content":"AudiA6 allegedly operated as an industrial-scale, fee-based cryptocurrency laundering service marketed to ransomware actors and other cybercriminals. According to the US Department of Justice and the US Secret Service, the service accepted cryptocurrency derived from criminal activity and, within approximately one hour, returned laundered funds to customers after routing them through a complex chain of transactions designed to obscure their origin. The service charged fees of up to 5% per transaction according to the DOJ and Secret Service; reporting from Europol and other outlets placed the fee range between 3% and 10%. The service allegedly processed approximately 10,333 Bitcoin since its launch in 2021, with a total estimated value at the time of transactions of approximately $389.7 million (EUR 336 million). Approximately 80% of traced illicit exposure — roughly $63 million of $79 million in directly attributable flows — was tied to ransomware proceeds, according to blockchain analytics firm TRM Labs.","heading":"Overview and Alleged Operations","severity":"critical","sources":[{"credibility":1,"name":"US Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":1,"name":"DOJ EDPA: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"TRM Labs: International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"}]},{"content":"The US Department of Justice charged two individuals in the Eastern District of Pennsylvania in connection with AudiA6. Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national, were both residing in Batumi, Georgia at the time of their arrest. Both were arrested on June 10, 2026, and are described by the DOJ as having served as senior members managing the operation. Each defendant faces one count of conspiracy to launder monetary instruments and one count of sting money laundering, with a maximum sentence of 20 years imprisonment per count. As of the date of this report, Tkachuk and Ledenev are in the custody of Georgian authorities. The US Attorney's Office for the Eastern District of Pennsylvania has stated it will seek their extradition to the United States. These are criminal charges; no conviction or adjudicated finding of guilt has been entered.","heading":"Alleged Operators and Criminal Charges","severity":"critical","sources":[{"credibility":1,"name":"US Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":1,"name":"DOJ EDPA: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"The Block: DOJ charges two in $389 million AudiA6 crypto laundering case","type":"news_article","url":"https://www.theblock.co/post/404433/doj-charges-two-389-million-audia6-crypto-laundering-case"},{"credibility":2,"name":"Cryptopolitan: US to seek extradition of AudiA6 duo over $389M crypto laundering scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"}]},{"content":"According to law enforcement and blockchain analytics sources, AudiA6 operated using a network of more than 6,000 Know Your Customer (KYC)-verified money mule accounts opened with stolen or purchased identities at centralized cryptocurrency exchanges. Criminal customers contacted AudiA6 operators through private messaging applications. Once funds were deposited, they were passed through multiple wallets and exchange accounts — many linked to Russian-speaking intermediaries — to obscure the chain of custody. According to the DOJ, the service explicitly marketed itself as able to 'conceal and disguise the source' of customer cryptocurrency. Laundered funds were typically returned to customers within approximately one hour of deposit. AudiA6 operated commercial and controlled email domains to register exchange accounts and maintain operational infrastructure. TRM Labs identified a broader industry trend in which mixer volumes declined from $152 million in 2021 to $48 million in 2024, while cross-chain bridge flows reached $100 million in 2025, suggesting services like AudiA6 evolved their techniques over time.","heading":"Laundering Methodology","severity":"critical","sources":[{"credibility":1,"name":"US Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":2,"name":"Help Net Security: Authorities dismantle crypto laundering service that moved EUR 336 million","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"credibility":2,"name":"TRM Labs: International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"}]},{"content":"On-chain analysis by TRM Labs identified 20 distinct ransomware groups that allegedly sent funds to AudiA6. The three largest by volume were ALPHV/BlackCat (approximately $9.1 million), Qilin (approximately $7.1 million), and LockBit (approximately $4.4 million). Additional ransomware groups identified by TRM Labs as AudiA6 customers include Chaos/Blacksuit ($3.65 million), RansomHub ($975,900), Akira ($386,200), and a group identified as The Gentlemen ($99,600). Europol and the DOJ stated that AudiA6 was linked to more than 15 investigations worldwide related to ransomware attacks and large-scale cryptocurrency theft. Separately, TRM Labs traced approximately $7 million in funds stolen during the 2022 LastPass data breach from Wasabi Wallet to AudiA6 as recently as September 2025, using cluster-level demixing, timing and amount alignment, and post-mix wallet analysis. These findings represent blockchain analytics attributions, not adjudicated court findings.","heading":"Ransomware Gang Clientele","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"}]},{"content":"The suspected operators of AudiA6 are also believed to have administered Dark2Web, a dark web cybercrime forum described by Europol as a marketplace where cybercriminals advertised illicit services and connected with other threat actors worldwide. The DOJ takedown operation seized infrastructure for both AudiA6 and the Dark2Web forum simultaneously. Law enforcement seizure banners were placed on both clear web and dark web domains associated with both services. The Dark2Web forum is treated by investigators as part of the same criminal enterprise as the AudiA6 laundering service, providing dual infrastructure for both ransomware proceeds processing and cybercrime coordination. Attribution of the Dark2Web forum to Tkachuk and Ledenev is alleged by law enforcement and has not yet been adjudicated.","heading":"Dark2Web Cybercrime Forum","severity":"critical","sources":[{"credibility":2,"name":"Hackread: Feds Seize AudiA6 and Dark2Web in $389M Crypto Laundering Case","type":"news_article","url":"https://hackread.com/feds-seize-audia6-dark2web-crypto-laundering-case/"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":2,"name":"Help Net Security: Authorities dismantle crypto laundering service that moved EUR 336 million","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"}]},{"content":"The takedown of AudiA6 was coordinated by the US Secret Service and the IRS Criminal Investigation division, in partnership with Europol, Eurojust, and law enforcement agencies from 11 additional countries: Australia, Canada, France, Georgia, Germany, Iceland, Japan, Poland, Switzerland, and the United Kingdom. Coordinated action took place on June 10, 2026. As part of the operation, law enforcement seized over 30 servers, took down 25 domains, seized more than 80 vehicles, confiscated multiple properties in Georgia, blocked associated Telegram accounts, and froze cryptocurrency assets. Approximately 393.39 BTC (valued at approximately $19.2 million at the time) were seized or traced as directly illicitly sourced. An additional EUR 692,000 in cryptocurrency was frozen and EUR 86,000 in cash was seized. Seizure banners were placed on all affected domains including both AudiA6 and Dark2Web infrastructure. A prior arrest of one Ukrainian suspect in connection with the broader investigation had been carried out by Polish police in September 2025.","heading":"International Law Enforcement Operation","severity":"high","sources":[{"credibility":1,"name":"US Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":1,"name":"DOJ EDPA: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"Help Net Security: Authorities dismantle crypto laundering service that moved EUR 336 million","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"credibility":1,"name":"Europol: Ransomware gangs cut off from EUR 336 million AudiA6 crypto laundering pipeline (via FDIC OIG)","type":"regulatory","url":"https://www.fdicoig.gov/news/investigations-press-releases/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering"}]},{"content":"Twenty-five domains associated with AudiA6 and its supporting infrastructure were seized as part of the June 2026 operation. Identified domains include designli.pictures, pheontx.eu, smplfy.in, sumato-soft.org, technobrains.dev, lett.email, trayo.app, postfast.eu, inboxly.top, and quix.express, among others. These domains appear to have been used for email account registration at cryptocurrency exchanges and other operational purposes. Servers located in the United States, Iceland, Germany, and France were also targeted. AudiA6's dark web and clear web sites were replaced with law enforcement seizure banners following the operation.","heading":"Seized Infrastructure","severity":"high","sources":[{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":2,"name":"Help Net Security: Authorities dismantle crypto laundering service that moved EUR 336 million","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"}]},{"content":"As of June 2026, Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev remain in the custody of Georgian authorities following their arrest in Batumi, Georgia on June 10, 2026. The US Attorney's Office for the Eastern District of Pennsylvania has stated it will seek extradition of both defendants to the United States to face the filed charges. No extradition has been confirmed as of the date of this report. Georgia is the country of the Republic of Georgia; both suspects were residing there at the time of their arrest.","heading":"Extradition Status","severity":"medium","sources":[{"credibility":2,"name":"Cryptopolitan: US to seek extradition of AudiA6 duo over $389M crypto laundering scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"},{"credibility":2,"name":"Protos: AudiA6 crypto laundering suspects face extradition to US","type":"news_article","url":"https://protos.com/audia6-crypto-laundering-suspects-face-extradition-to-us/"},{"credibility":1,"name":"US Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"}]}],"sources_used":[{"credibility":1,"name":"DOJ EDPA: Two Charged in Connection With Cryptocurrency Money Laundering Service That Allegedly Laundered Over $389 Million","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":1,"name":"US Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":1,"name":"Europol via FDIC OIG: Ransomware gangs cut off from EUR 336 million AudiA6 crypto laundering pipeline","type":"regulatory","url":"https://www.fdicoig.gov/news/investigations-press-releases/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering"},{"credibility":2,"name":"TRM Labs: International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"Chainalysis: Global Law Enforcement Dismantles AudiA6 Crypto Laundering Network","type":"research","url":"https://www.chainalysis.com/blog/law-enforcement-dismantles-audia6-laundering-network-june-2026/"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":2,"name":"Help Net Security: Authorities dismantle crypto laundering service that moved EUR 336 million for cybercriminals","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"credibility":2,"name":"The Block: DOJ charges two in $389 million AudiA6 crypto laundering case","type":"news_article","url":"https://www.theblock.co/post/404433/doj-charges-two-389-million-audia6-crypto-laundering-case"},{"credibility":2,"name":"Cryptopolitan: US to seek extradition of AudiA6 duo over $389M crypto laundering scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"},{"credibility":2,"name":"Protos: AudiA6 crypto laundering suspects face extradition to US","type":"news_article","url":"https://protos.com/audia6-crypto-laundering-suspects-face-extradition-to-us/"},{"credibility":2,"name":"Hackread: Feds Seize AudiA6 and Dark2Web in $389M Crypto Laundering Case","type":"news_article","url":"https://hackread.com/feds-seize-audia6-dark2web-crypto-laundering-case/"},{"credibility":2,"name":"Cybernews: Crypto laundering service AudiA6 shut down","type":"news_article","url":"https://cybernews.com/cybercrime/audia6-crypto-washing-shut-down/"}],"summary":"AudiA6 was a professional cryptocurrency money laundering service allegedly operating from 2021 through 2025, accused of processing approximately $389.7 million (EUR 336 million) in illicit funds for ransomware gangs and other cybercriminals. The service also administered the Dark2Web dark web cybercrime forum. A US-led international law enforcement operation dismantled AudiA6's infrastructure on June 10, 2026, and two alleged operators were arrested in Batumi, Georgia and charged by the US Department of Justice.","timeline":[{"date":"2021-01-01","event":"AudiA6 cryptocurrency laundering service alleged to have launched operations, according to DOJ and on-chain analytics.","source":"US Secret Service / TRM Labs","source_url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"date":"2022-01-01","event":"AudiA6 begins receiving illicit funds traceable to the 2022 LastPass data breach, according to later TRM Labs on-chain analysis.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"date":"2025-09-01","event":"Polish police arrest one Ukrainian suspect in connection with a related AudiA6 investigation, providing an early investigative lead.","source":"Help Net Security / The Hacker News","source_url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"date":"2025-12-01","event":"TRM Labs traces approximately $7 million in stolen LastPass funds from Wasabi Wallet to AudiA6 wallets using cluster-level demixing and timing analysis.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"date":"2026-06-10","event":"Coordinated international law enforcement operation dismantles AudiA6. Ruslan Igorevich Tkachuk (37) and Alexander Vladimirovich Ledenev (25) are arrested in Batumi, Georgia. Over 30 servers seized, 25 domains taken down, 80+ vehicles seized, Telegram accounts blocked, and cryptocurrency assets frozen.","source":"DOJ / US Secret Service / Europol","source_url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"date":"2026-06-11","event":"DOJ files criminal complaint in Eastern District of Pennsylvania. Europol and Chainalysis publish operational details. Seizure banners placed on AudiA6 and Dark2Web infrastructure.","source":"DOJ EDPA / Chainalysis / Europol","source_url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"date":"2026-06-12","event":"Europol, Help Net Security, The Hacker News, and other outlets publish comprehensive coverage. TRM Labs identifies 20 distinct ransomware groups as AudiA6 customers.","source":"TRM Labs / Help Net Security","source_url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"}]},"v":1}