An international law enforcement operation among 11 countries has shut down AudiA6, a money laundering ring that processed over 336 million euros ($390 million) in illicit funds between 2022 and 2025.
On Wednesday, authorities arrested two administrators, Russian and Ukrainian nationals, in Georgia, seized 25 domains and more than 30 servers and 80 vehicles and froze roughly $900,000 in cryptocurrency, the European Union Agency for Criminal Justice Cooperation (Eurojust) said Thursday.
The AudiA6 “mixer-as-a-service” was used by cybercriminals involved in ransomware attacks to cash out stolen crypto and conceal the movement of illicit funds from authorities by offering to “clean” crypto within about an hour for a 3% to 10% commission.
Since 2021, AudiA6 wallets received approximately 10,333 BTC, valued at around $389 million at the time the transactions occurred, Chainalysis reported.
The cybercrime syndicate behind the service is also reportedly running a separate marketplace forum known as “Dark2Web”, which is used to advertise illicit services and connect cybercriminals worldwide, according to Eurojust.
The investigation involved agencies from the United States, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the United Kingdom, coordinated through Eurojust and Europol.
Fake KYC accounts used in scheme
The crypto laundering ring was facilitated by thousands of fraudulent accounts using stolen or purchased identities.
More than 6,000 Know Your Customer (KYC) records linked to “money mule accounts” were identified during the investigation, Eurojust said.
Many of those accounts were connected to Russian-speaking intermediaries recruited specifically to help move criminal proceeds through crypto exchanges, it added.
Related: Ransomware attacks surge 50% in 2025, ransom payments decline
AudiA6 also reportedly laundered part of a ransom paid by an Australian business in 2024 following a ransomware extortion attack, according to the Australian Federal Police, which was part of the investigation.
Both the regular and dark web versions of AudiA6 and Dark2Web domains have been replaced with seizure banners.
A multinational law enforcement effort led to the closure of the platforms. Source: Europol
Ransomware consolidates around a few operators
Ransomware was recorded in 97 countries during the first quarter of 2026, but the distribution of attacks is becoming increasingly concentrated, with the US accounting for 64.7% of all recorded victims, according to Emsisoft.
“The ransomware ecosystem is once again consolidating around fewer, more dominant operators,” with the top 10 ransomware groups accounting for 71% of all Q1 2026 victims, reported Check Point Research in May.
Magazine: Does ‘Paper Bitcoin’ mean there’s an unlimited supply of BTC?