Authorities shut down €336M crypto laundering hub for cybercriminals
▼ Summary
– An international operation dismantled the AudiA6 cryptocurrency laundering service, which processed over €336 million in illicit funds linked to ransomware and cybercrime from 2022 to 2025.
– AudiA6 operators also administered the Dark2Web dark web forum, a marketplace connecting cybercriminals globally, and offered a mixing service with fees of 3% to 10%.
– The investigation uncovered over 6,000 KYC records from money mule accounts and linked AudiA6 to at least 15 international investigations.
– On June 10, two alleged administrators were arrested in Georgia, with seizures including over 30 servers, 25 domains, 80 vehicles, properties, and approximately €778,000 in cryptocurrency.
– The operation built on a prior Polish police arrest of a Ukrainian suspect in September 2025, involving agencies like the U.S. Secret Service, IRS Criminal Investigation, Europol, and Eurojust.
An international law enforcement sweep has successfully dismantled a cryptocurrency laundering hub that serviced ransomware groups and other cybercriminals, processing over €336 million in illegal funds.
Europol confirmed the service, operating under the name AudiA6, is believed to have laundered cryptocurrency obtained from ransomware attacks and other cybercrimes between 2022 and 2025. The agency stated that the individuals behind AudiA6 are also suspected of running the dark web forum Dark2Web, a criminal marketplace that connected cybercriminal actors globally and advertised illicit services.
AudiA6 promoted itself on cybercrime forums as a cryptocurrency mixing service. Customers reportedly received cleaned funds in roughly one hour, with operators charging fees between 3% and 10%.
Investigators uncovered more than 6,000 Know Your Customer (KYC) records tied to money mule accounts that funneled illicit funds through cryptocurrency exchanges. Europol noted that the service was connected to at least 15 international investigations.
On June 10, a coordinated operation led to the arrest of two alleged administrators in Georgia. Authorities searched three properties, seized more than 30 servers, took down 25 domains, and blocked Telegram accounts linked to the service. The operation also resulted in the seizure of more than 80 vehicles and multiple properties in Georgia. Approximately €692,000 in cryptocurrency was frozen, and over €86,000 was seized.
Europol explained that this operation built on an earlier investigation by Polish police, which led to the arrest of a Ukrainian suspect in September 2025. Investigators analyzed electronic devices seized during that arrest and used the information to identify other individuals allegedly involved in the money laundering network.
The investigation involved the U. S. Secret Service, IRS Criminal Investigation, the Polish Police, Europol, Eurojust, and other international law enforcement partners.
(Source: Help Net Security)
