An international law enforcement operation conducted in 11 countries led to the closure of AudiA6, a money laundering network that processed illegal funds worth over €336 million ($390 million) between 2022 and 2025.
On Wednesday, authorities arrested two administrators, citizens of Russia and Ukraine, in Georgia, seized 25 domains and more than 30 servers and 80 vehicles, and froze cryptocurrency worth approximately $900,000, European Union Agency for Justice Cooperation in Criminal Matters (Eurojust) he said Thursday.
The AudiA6 “mixer as a service” was used by cybercriminals involved in ransomware attacks to cash out stolen cryptocurrencies and hide the flow of illicit funds from authorities by offering to “clean” cryptocurrencies in about an hour for a commission of 3% to 10%.
As of 2021, AudiA6 wallets received approximately 10,333 BTC, worth approximately $389 million at the time of the transaction, Chainalytic reported.
The cybercrime syndicate behind the service also reportedly operates a separate trading forum known as “Dark2Web” that is used to advertise illegal services and connect with cybercriminals according to Eurojust worldwide.
The investigation involved agencies from the United States, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the United Kingdom and was coordinated through Eurojust and Europol.
Fake KYC accounts used in the scheme
The cryptocurrency laundering ring was facilitated by thousands of imitation accounts using stolen or purchased identities.
Over 6 thousand Get to know your customer Eurojust said the investigation identified records linked to “money mule accounts.”
It added that many of these accounts were linked to Russian-speaking intermediaries recruited specifically to assist flow criminal proceeds through cryptocurrency exchanges.
Related: Ransomware attacks will boost by 50% in 2025 and ransom payments will decline
AudiA6 also reportedly laundered part of the ransom paid by the Australian company in 2024 following a ransomware extortion attack. According to Australian Federal Police who were part of the investigation.
Both the regular and gloomy versions of the AudiA6 and Dark2Web domains have been replaced with capture banners.
Multinational law enforcement efforts led to the closure of the platforms. Source: Europol
Ransomware is consolidating around several operators
In the first quarter of 2026, ransomware was reported in 97 countries, but the distribution of attacks is becoming increasingly concentrated, with 64.7% of all recorded victims in the United States. According to to Emsisoft.
“The ransomware ecosystem is once again consolidating around fewer, more dominant operators,” with the top 10 ransomware groups accounting for 71% of all victims in the first quarter of 2026, reported Check Point tests in May.
Warehouse: Does “Paper Bitcoin” mean an unlimited supply of BTC?
