AudiA6 crypto laundering service taken down: €336M allegedly washed for ransomware gangs

An international operation backed by Europol and Eurojust has shut down AudiA6, a cryptocurrency laundering service that investigators say ransomware crews used to cash out more than €336 million. There's no patch to apply here. The case matters to engineering teams because it shows how stolen crypto actually gets converted to cash, and because the mule accounts behind it were registered with email domains that platforms can now block.

What happened

On 10 June 2026, Georgian authorities arrested two alleged AudiA6 administrators, searched three properties, seized more than 30 servers, took down 25 domains, blocked related Telegram accounts and seized more than 80 vehicles and several properties. About €692,000 in cryptocurrency was frozen and more than €86,000 seized. The Hacker News, citing the U.S. Justice Department, named the two men as Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25.

Eurojust says AudiA6 laundered more than €336 million (about $389 million) in criminal crypto between 2022 and 2025. Europol links it to more than 15 international investigations into ransomware and large-scale crypto theft. The group is also accused of running Dark2Web, a cybercrime marketplace. The case grew out of a Polish investigation: a co-perpetrator was arrested in Poland in September 2025, and devices seized then helped identify the others. The Georgian detentions were based on a red diffusion issued by the Regional Prosecutor's Office in Łódź, after an investigation by Poland's Central Cybercrime Bureau. Authorities in the U.S. (including the Eastern District of Pennsylvania, USSS, IRS-CI and HSI), France, Poland, Georgia and Iceland took part.

According to Eurojust, customers sent stolen crypto to wallets the group controlled and got "cleaned" funds back within about an hour, after a chain of transactions designed to hide where the money came from. The fee was 3–10%. To get money out through exchanges, the operators used thousands of accounts opened with stolen or purchased identities. Investigators found more than 6,000 KYC records tied to money-mule accounts.

Who is affected

• Ransomware and crypto-theft groups that relied on AudiA6 to cash out. Some may now be traceable through the seized servers.
• Crypto exchanges and fintech onboarding teams, whose KYC processes were bypassed with mule identities.
• Past victims, including the 2022 LastPass breach, whose stolen funds TRM Labs previously traced through AudiA6 and Cryptex.

What it means for developers and engineering teams

For most teams the direct impact is small. The ecosystem signal is still worth noting. Ransomware is a business, and its weakest point is turning crypto into usable money. Shutting down laundering services raises the cost of every attack. For engineers who build onboarding, payments or exchange products, AudiA6 relied on mass-produced mule accounts, and Eurojust published 19 domains the group used to register them. Examples include pheontx.eu, postfast.eu, mailora.eu, lettermail.eu and deliverlett.com. Checking new accounts against domain reputation at signup is a cheap control, and here it would have flagged a real laundering operation.

The seizure of more than 30 servers and over 6,000 KYC records also matters. Laundering services keep records of who sent what, and those records now belong to investigators. Past users of AudiA6 may be identified months from now, and operations like this one regularly produce follow-up arrests and ransomware-affiliate identifications.

What to do now

• If you run signup or KYC flows, add the 19 published AudiA6 mule domains to your disposable or high-risk email denylist and review existing accounts registered with them.
• Flag clusters of accounts that share devices, IP ranges, document templates or registration email domains. Mule farms show up as clusters.
• Screen inbound and outbound crypto transfers with a blockchain-analytics provider, and update the screening when new sanctions or law-enforcement attributions are published.
• For ransomware readiness, assume paying won't stay anonymous. Document a policy for engaging law enforcement before any payment is discussed.

Related on TechLogHub

• Orisift: email-domain, IP and phone checks through one API
• Authentication: identity checks at signup

Sources

• Eurojust: Cryptocurrency money laundering site shut down (11 June 2026), including the list of 19 mule domains
• Europol: Ransomware gangs cut off from EUR 336 million AudiA6 crypto laundering pipeline
• The Hacker News: Europol disrupts AudiA6 crypto laundering service
• Help Net Security: Authorities dismantle crypto laundering service that moved €336 million