- Global operation dismantles AudiA6 network with arrests, seizures, and domain takedowns.
- Authorities arrested two suspects and seized servers, domains, vehicles, and crypto.
- Authorities identify over 6,000 fake KYC records tied to crypto money mule accounts.
International law enforcement agencies have shut down an alleged cryptocurrency laundering network accused of helping cybercriminals hide proceeds from ransomware attacks and other illicit activities. The operation, which spanned multiple countries, resulted in arrests, asset seizures, domain takedowns, and the freezing of cryptocurrency linked to the AudiA6 service.
Authorities allege that AudiA6 operated as a cryptocurrency laundering platform that enabled criminal groups to move stolen digital assets through a network of transactions designed to obscure their origins. Investigators say the service operated alongside Dark2Web, a separate cybercrime forum that allegedly advertised illicit services and connected cybercriminals across regions.
Arrests and Asset Seizures in Georgia
The enforcement actions took place on June 10 in Georgia, where authorities arrested two suspected administrators linked to the operation. U.S. authorities later identified them as Ukrainian national Tkachuk and Russian national Ledenev, who are currently in Georgian custody and face extradition requests from the United States.
Investigators also inspected three properties and seized more than 30 servers, 25 internet domains, more than 80 vehicles, and multiple properties believed to be connected to the network. In addition, approximately €692,000 in cryptocurrency was frozen, while more than €86,000 in digital assets was seized.
According to investigators, customers of the service would transfer cryptocurrency to wallets controlled by the organization and receive different cryptocurrencies back within about an hour. The process allegedly involved multiple transactions intended to conceal the movement of funds. The operators are accused of charging commissions ranging from 3% to 10%.
International Investigation Spanned Multiple Countries
The investigation involved cooperation between law enforcement and judicial authorities from several jurisdictions. Eurojust coordinated efforts among agencies in France, Poland, Georgia, Iceland, and the United States, while Europol’s European Cybercrime Centre traced cryptocurrency flows and analyzed the financial infrastructure allegedly used by the group.
Authorities noted that one alleged co-perpetrator had already been arrested in Poland in September 2025. The recent arrests in Georgia were carried out following a red diffusion issued through a Polish investigation led by the Central Cybercrime Bureau and the Regional Prosecutor’s Office in Łódź.
Thousands of Fake Accounts Identified
Investigators said the laundering operation relied heavily on fake accounts created using stolen or purchased identities. More than 6,000 Know Your Customer records connected to money mule accounts were identified during the investigation.
Authorities allege that many of these accounts were linked to Russian-speaking intermediaries recruited to move funds through cryptocurrency exchanges. The group reportedly used both commercial email providers and domains under its control to register accounts used in the laundering process.
Related: 22-Year-Old Gets 70 Months Prison for Role in $263M Crypto Laundering Scheme
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
