Europol Shuts Down AudiA6: $389M Laundered Through Crypto Service

Europol and U.S. intelligence services have dismantled the crypto service AudiA6, which investigators say was used to launder nearly $389 million. This case matters for traders, crypto holders, and anyone following market security, because the service had been operating since 2021 and became a hub for ransomware-group funds.

The case involves two suspects: 37-year-old Ukrainian citizen Ruslan Tkachuk and 25-year-old Russian citizen Alexander Ledenev. They were detained in Batumi, and the U.S. will now seek their extradition. According to investigators, AudiA6 was used not only for laundering but also to support the Dark2Web forum, where crimes against specific targets were ordered.

Why did AudiA6 become such a big case?

AudiA6 was not a small exchange on the fringe. According to investigators, about €336 million passed through it, or nearly $389 million, and the service was mentioned in at least 15 international cybercrime investigations. This is no longer a random system failure, but a channel that had been working for years for major criminal groups.

There is another important detail. The investigation found that about 80% of the illicit funds that passed through AudiA6 were directly linked to ransomware operators. For the market, the message is simple: even when there are hundreds of such services, the entry points convenient for criminals remain highly concentrated. That is why one operation can hit an entire chain.

What is known about the arrests, searches, and seizures?

The investigation went far beyond one country. According to Eurojust, on June 10, 2026, an action day was carried out in Georgia: 3 locations were searched, 25 domains were taken down, more than 30 servers were seized, as well as more than 80 cars and several real estate properties. Separately, €692,000 in crypto assets were frozen and another €86,000+ was seized.

The infrastructure was hit simultaneously in several jurisdictions, including the U.S., Iceland, Germany, and France. The network’s Telegram accounts were also blocked. This looks less like a targeted strike and more like a synchronized shutdown of all the doors that kept the service afloat.

According to the U.S. Department of Justice, since AudiA6 launched in 2021, about 10,333 BTC were received into its wallets. Of that amount, at least 393.39 BTC, worth approximately $19.23 million at the time of the transactions, came directly from darknet markets, ransomware structures, and other illegal sources.

Market reaction

For the broader crypto market, this news is not about the immediate price, but about the risk structure. TRM Labs notes that each year, ransomware-related funds pass through 600 to 760 services, but the top 5 account for 42% to 57% of the total volume. In 2025, the top-5 share rose again to 51% after a brief decline caused by a series of law enforcement operations.

In other words, the system is not spread thinly across the entire market. It depends on a small number of nodes. That is why each such shutdown can create a short-term effect for criminals, but it does not eliminate the problem entirely. In 2025, according to TRM Labs, ransomware groups received about $1.3 billion, while actual ransom payments stood at around $850 million. That is a scale you cannot hide behind pretty words.

• AudiA6 had been operating since 2021.

• About €336 million, or nearly $389 million, passed through the service.

• Investigators link it to at least 15 international cases.

• In Georgia on June 10, 2026, 3 locations were searched and 25 domains were taken down.

• More than 30 servers, more than 80 cars, and several real estate properties were seized.

• In the U.S., the two suspects face up to 20 years in prison.

What does this mean for investors?

For investors, two points matter here. First, regulators and law enforcement are increasingly targeting infrastructure, not just individual wallets. Second, suspicion of laundering through a crypto service quickly leads to domain blocks, server seizures, account freezes, and disrupted flows, meaning the risk for any service with poor customer checks is rising.

There is also a practical takeaway for Ukrainian users. If you work with crypto assets, it is worth looking not only at the price, but also at whether a service carries toxic compliance history. For those cashing out BTC into hryvnia, a fast and straightforward sell Bitcoin on Monobank option can be a convenient choice without extra steps.

TRM Labs also notes that criminals are increasingly moving not to mixers, but to cross-chain bridges. This matters because laundering schemes are changing faster than many people think. That is why operations against services like AudiA6 are likely something we will see again.

Frequently asked questions

What is AudiA6 and why was it shut down?

AudiA6 was a crypto service that investigators link to laundering funds for ransomware groups. According to the case, about $389 million passed through it, and the service was mentioned in at least 15 international investigations.

Who was detained in the AudiA6 case?

Two suspects were arrested in Batumi: 37-year-old Ukrainian citizen Ruslan Tkachuk and 25-year-old Russian citizen Alexander Ledenev. The U.S. plans to seek their extradition, and each defendant faces up to 20 years in prison.

Why is this case important for the crypto market?

It shows that law enforcement can strike at major hubs through which hundreds of millions of dollars flow. For the market, this means more scrutiny of services that do not verify the origin of funds, and more risk for platforms with weak controls.

The AudiA6 story clearly shows how modern crypto crime works: a lot of money, a narrow circle of services, several countries, and a fast law enforcement response. If you need to convert BTC into hryvnia without extra hassle, you can use the service and avoid wasting time on complicated schemes.

This material is not financial advice. Cryptocurrency trading involves significant risks. Part of this text was prepared with the help of artificial intelligence based on public sources and reviewed by our editorial team.