Mixers, Makers, and Takedowns: AudiA6 Laundered $389M and Allegedly Bragged About It 🧅

U.S. prosecutors have charged two alleged operators of the AudiA6 cryptocurrency laundering network with processing more than $389 million in illicit digital asset transactions and helping users bypass exchange anti-money-laundering controls. Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25, were arrested in the Republic of Georgia following a coordinated international takedown announced by the U.S. Attorney's Office for the Eastern District of Pennsylvania. The defendants are charged with one count of conspiracy to launder monetary instruments and one count of sting money laundering and are being held in Georgia while the U.S. seeks their extradition. Each faces up to 20 years in prison if convicted.

According to the unsealed complaint, AudiA6 wallets received approximately 10,333 BTC since 2021, valued at more than $389 million at the time of the transactions, with around $19 million traced directly from known illicit sources. Chainalysis and law enforcement analysts tracked the funds to darknet markets, ransomware operators, cybercrime services and other criminal activity, while the European Union Agency for Criminal Justice Cooperation (Eurojust) said the network processed more than 336 million euros ($390 million) in illicit funds between 2022 and 2025. Investigators alleged the service charged commissions of up to 5%, and Eurojust said the operation marketed "cleaning" of cryptocurrency within about an hour for a 3% to 10% fee.

The complaint described AudiA6 as more than a simple crypto mixer, alleging it maintained darknet forums, escrow systems, exchange services, Telegram channels, Tor websites, and cross-chain conversion infrastructure, and that it operated the separate Dark2Web cybercrime forum used to advertise illicit services. Prosecutors said the operators used terms such as "dirty" and "clean" crypto while promising to "cut off your tails," a phrase investigators said referred to removing blockchain traces linked to criminal activity. The complaint also said the service promised laundered funds would carry an AML risk score below 25%, a threshold investigators said many exchanges rely on when screening transactions, and quoted an AudiA6 representative responding to an undercover inquiry about mixing stolen ETH from scams with "yes, no problem."

The takedown involved agencies from the United States, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the United Kingdom, coordinated through Eurojust and Europol. On June 10, authorities searched three properties, seized 25 domains, more than 30 servers and 80 vehicles, blocked accounts on messaging platform Telegram, and froze roughly 778,000 euros ($900,000) in cryptocurrency, replacing AudiA6 and Dark2Web sites with seizure banners. Eurojust said investigators identified more than 6,000 fraudulent Know Your Customer records linked to "money mule accounts" used to move criminal proceeds through exchanges, many connected to Russian-speaking intermediaries.

The Australian Federal Police, which participated in the investigation, said AudiA6 laundered part of a ransom paid by an Australian business in 2024 following a ransomware extortion attack. Separately, pseudonymous blockchain researcher ZachXBT has alleged that funds stolen through a fake Ledger app distributed via the Mac App Store were laundered through AudiA6's services. AudiA6's takedown comes amid broader reporting that ransomware was recorded in 97 countries during the first quarter of 2026, with the top 10 ransomware groups accounting for 71% of all Q1 2026 victims according to Check Point Research.