A coordinated international law enforcement operation has dismantled AudiA6,a cryptocurrency laundering service linked to ransomware gangs and other cybercriminal activities. The crackdown, which took place on June 10, resulted in arrest of two alleged administrators in Georgia and seizure of significant digital assets and infrastructure used by the platform.
Authorities apprehended Ruslan Igorevich Tkachuk, 37,a Ukrainian national, and Alexander Vladimirovich Ledenev,25,a Russian national, in Batumi. They face charges in the Eastern District of Pennsylvania for conspiracy to launder monetary instruments and money laundering. U.S. officials are seeking their extradition to face trial .
The operation involved multiple agencies,including the U.S. Secret Service,IRS Criminal Investigation,Europol, and law enforcement from countries such as Australia, Canada,France,Germany, and the United Kingdom. Investigators executed searches at three locations, took down 25 domains,and seized over 30 servers. They also froze approximately €692,000 in cryptocurrency and confiscated more than €86,000 in digital assets. In addition, over 80 vehicles and several properties in Georgia were seized .
Between 2022 and 2025,AudiA6 allegedly processed illicit funds exceeding €336 million,serving as a crucial cash-out pipeline for criminal organizations. The platform facilitated the conversion of traceable cryptocurrency into seemingly clean funds, often returning cleaned assets within an hour for commissions ranging from 3% to 10%.
Investigators discovered over 6,000 records linked to money mule accounts,indicating that the laundering network exploited compromised identities to navigate regulated exchanges while obscuring the origins of funds. case underscores the role of laundering brokers in sustaining ransomware operations, where the ability to cash out is as critical as the malware itself.
Since its inception in 2021, AudiA6 wallets reportedly received around 10,333 bitcoin, valued at approximately $389.7 million at the time. Of this, about 393.39 bitcoin,worth roughly $19.2 million, originated from known darknet markets and ransomware organizations. The alleged operators also managed Dark2Web,a cybercrime forum that advertised illegal services and connected users within the underground market .
This operation follows an earlier arrest in Poland in September 2025, where electronic devices seized led to identification of additional individuals involved in laundering network. The recent takedown reflects a broader enforcement strategy targeting financial infrastructure supporting ransomware, rather than solely focusing on the hacking groups themselves.
Despite increased resistance from victims,ransomware payments remained substantial in 2025, with ongoing leak-site activity and opportunistic attacks continuing to pressure various sectors . allegations against Tkachuk and Ledenev have yet to be tested in court,but if convicted, they could face up to 20 years in prison. The next steps will depend on Georgian custody and extradition proceedings, while seized servers and financial records are expected to aid ongoing investigations into cybercrime laundering routes across multiple jurisdictions.
