An international law enforcement operation has dismantled a cryptocurrency laundering service known as ‘AudiA6’, which investigators say was used by ransomware gangs and other cybercriminal networks to hide illicit profits.
The service is suspected of laundering more than €336 million between 2022 and 2025, Europol reported.
Investigators believe it was used by criminals trying to cash out stolen digital assets while obscuring where the money came from.
Two alleged administrators — described as Ukrainian and Russian nationals — were arrested in Georgia on 10 June.
Authorities also searched three properties, took down 25 domains and seized more than 30 servers.
More than 80 vehicles and multiple properties were seized in Georgia during the action, and €692,000 in cryptocurrency was frozen with a further €86,000 seized.
Telegram accounts used by the network were blocked, and websites linked to ‘AudiA6’ and a related dark web forum were replaced with a law enforcement seizure banner.
The suspects behind ‘AudiA6’ are also believed to have administered a dark web cybercrime forum called ‘Dark2Web’, which investigators describe as a marketplace used to advertise illicit services and connect cybercriminals.
The operation involved parallel investigations by the United States Secret Service and IRS Criminal Investigation, and by the Polish Police, with support from Europol and Eurojust.
How investigators say the laundering worked
Investigators uncovered what they described as an industrial-scale operation using thousands of fraudulent exchange accounts opened with stolen or bought identities, Europol said.
Analysis by Europol linked the service to more than 15 international investigations involving ransomware attacks and large-scale cryptocurrency theft.
Customers would send stolen cryptocurrency to wallets controlled by the group and receive “cleaned” funds back in about an hour through a chain of transactions designed to hide the origin. The operators charged commissions of between 3 and 10 per cent.
An earlier investigation by the Polish Police led to the arrest of a Ukrainian national on 15 September 2025 in connection with money laundering linked to the AudiA6 group.
Electronic devices seized in that case were examined and helped investigators identify additional suspected participants.
Europol said more than 6,000 Know Your Customer records — information typically collected by financial services to verify identity — were identified and linked to so-called money mule accounts used to move funds.
Many of the mule accounts were connected to Russian-speaking intermediaries recruited to help shift criminal proceeds through cryptocurrency exchanges.
Participating authorities included police and prosecutors from countries including the UK, the US, Poland, France, Germany, Japan, Canada, Australia, Switzerland, Iceland and Georgia.
