AudiA6 crypto laundering service seized after moving over $389 million

What happened

US prosecutors charged two men by criminal complaint in connection with a cryptocurrency money laundering service known as AudiA6. According to the US Department of Justice (DOJ), Eastern District of Pennsylvania, Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national, are alleged senior members who managed AudiA6 and the linked Dark2Web cybercrime forum. Both reside in Batumi, Republic of Georgia.

The two face one count of conspiracy to launder monetary instruments and one count of sting money laundering. The DOJ alleges AudiA6 laundered more than $389 million in cryptocurrency. The service, prosecutors say, explicitly offered to conceal and disguise the source of a customer’s cryptocurrency that would otherwise be traceable to criminal sources, for a fee of up to five percent of the funds being laundered.

The takedown was coordinated internationally and executed on 10 June 2026. Europol estimates the service laundered more than EUR 336 million between 2022 and 2025. The operation was jointly led by the US Secret Service, IRS Criminal Investigation (IRS-CI), and Polish Police, with support from Europol and Eurojust. Authorities seized more than 30 servers, took down 25 domains, and replaced the AudiA6 and Dark2Web sites with a seizure banner. Tkachuk and Ledenev are in Georgian custody, and the US Attorney’s Office will seek extradition.

Why it matters

The marketing pitch was traceability. The reality, prosecutors say, was the opposite. Undercover federal agents ran six transactions posing as criminals laundering dirty Bitcoin and drug proceeds. US Attorney David Metcalf, quoted by the Philadelphia Inquirer, said the operators promised mixing would make funds untraceable, yet investigators found the transactions could be directly traced through exchange records.

That gap is the analytical point. A mixing or tumbling service does not erase a blockchain trail. It obscures it, and obscuration breaks down at the point where mixed funds touch a regulated exchange with know your customer (KYC) records. The same choke point that launderers rely on to cash out is the choke point investigators use to unwind the chain.

The case also shows where the dirty money came from. The DOJ alleges at least $20 million flowed directly from dark web criminal accounts tied to ransomware and stolen funds. Mixing services are not abstract crypto plumbing. They are a settlement layer for cybercrime proceeds.

Practitioner angle

For chain analytics and transaction monitoring teams, this is a prompt to revisit how mixer exposure is scored.

• Treat inflows with any mixer or tumbler heritage as high risk by default, not as a neutral signal to be netted out. Confirm your blockchain analytics provider flags AudiA6 and Dark2Web addresses, and review historical exposure to them.
• Do not assume mixed funds are untraceable. This case confirms that exchange records can reconstruct the path. Use that when you triage alerts and when you decide whether to file.
• Tighten detection of mule accounts at the cash-out stage. Europol’s summary links thousands of KYC records to mule accounts feeding this service. Look for newly onboarded accounts that receive mixed inflows and move them on quickly, accounts sharing device or network identifiers, and identity documents reused across customers.
• Tie crypto exposure scoring back to predicate typologies. Ransomware and stolen-funds proceeds were a meaningful share here, so a mixer hit should escalate, not just log.

The single most important action: reclassify mixed-fund inflows as high risk in your monitoring rules and re-run that logic against recent history to surface exposure you previously scored as clean.