Key facts
- An international law enforcement operation involving 11 countries has shut down the AudiA6 crypto money-laundering ring.
- The ring processed approximately $390 million in illicit funds between 2022 and 2025.
- Two administrators were arrested in Georgia, and significant assets including domains, servers, vehicles, and cryptocurrency were seized.
- AudiA6 operated as a mixer-as-a-service for cybercriminals, particularly those involved in ransomware attacks.
- The investigation identified over 6,000 fraudulent KYC records linked to money mule accounts.
- The syndicate also operated the Dark2Web marketplace for illicit services.
An international law enforcement operation involving 11 countries has successfully dismantled AudiA6, a sophisticated cryptocurrency money-laundering ring that processed an estimated 336 million euros ($390 million) in illicit funds between 2022 and 2025. The operation, coordinated by Eurojust and Europol, led to the arrest of two administrators, identified as Russian and Ukrainian nationals, in Georgia.
Authorities seized 25 domains, over 30 servers, and 80 vehicles, while freezing approximately 778,000 euros ($900,000) in cryptocurrency. AudiA6 operated as a "mixer-as-a-service," allowing cybercriminals, particularly those involved in ransomware attacks, to obscure the origin of stolen funds by cleaning cryptocurrencies for a commission ranging from 3% to 10%. Since 2021, AudiA6 wallets received about 10,333 BTC, valued at roughly $389 million at the time of the transactions, according to Chainalysis.
The syndicate behind AudiA6 also reportedly managed a separate marketplace forum called "Dark2Web," used to advertise illicit services and connect cybercriminals globally. The investigation revealed that the money-laundering scheme was facilitated by thousands of fraudulent accounts, many linked to Russian-speaking intermediaries, which utilized stolen or purchased identities. Over 6,000 Know Your Customer (KYC) records associated with "money mule accounts" were identified.
The Australian Federal Police confirmed that AudiA6 laundered funds from a ransomware attack on an Australian business in 2024. Both the regular and dark web versions of the AudiA6 and Dark2Web domains have been replaced with seizure banners, marking the culmination of a multinational law enforcement effort.