Europol and the U.S. Department of Justice moved on the ransomware cashout layer, arresting two alleged operators in Georgia and tracing roughly 393 BTC of the €336 million pipeline directly to darknet markets and ransomware actors.
For five years, ransomware operators and darknet market traders funneled stolen crypto through AudiA6, a service that mixed the funds, routed them through thousands of fraudulent exchange accounts, and delivered laundered proceeds within an hour. On June 10, 2026, the pipeline was cut.
The takedown, announced by Europol on June 11, exposes the cashout layer most ransomware reporting never reaches. Investigators estimate AudiA6 laundered more than €336 million in illicit profits since the service launched in 2021, charging 3 to 10 percent commissions on transactions that cleared within roughly an hour. Two alleged administrators, Ruslan Igorevich Tkachuk, a 37-year-old Ukrainian, and Alexander Vladimirovich Ledenev, a 25-year-old Russian, were arrested in Georgia on June 10, the same day enforcement teams seized 25 domains, more than 30 servers, and 80-plus vehicles, and froze €692,000 in cryptocurrency.
The mechanism, not the dollar figure, is what makes AudiA6 worth dissecting. The service ran on what the U.S. Department of Justice describes in its parallel indictment unsealed the same day as a laundering pipeline fed by approximately 10,333 Bitcoin deposits. Of that total, the DoJ alleges roughly 393.39 BTC, valued at about $19.23 million at the time of the transactions rather than at present market rates, flowed directly from known darknet markets, ransomware organizations, and other cybercrime services. The gap between the €336 million total and the DoJ's $19.23 million in directly traced illicit Bitcoin reflects how mixing layers fragment provenance. Customers sent dirty crypto to AudiA6-controlled wallets, the service routed funds through chains of transactions, and clean outputs were returned, often within an hour.
The fuel for that churn was identity fraud at industrial scale. According to Europol's account of the investigation, the operation uncovered more than 6,000 Know Your Customer records tied to money-mule accounts. AudiA6's operators opened thousands of fraudulent exchange accounts on stolen or purchased identities, giving the mixing pool a steady supply of clean endpoints. Operators coordinated over private messaging platforms. The laundering service and a dark-web cybercrime forum called Dark2Web, where illicit services were advertised and threat actors connected, are alleged to have been administered by the same individuals. The forum linkage remains described by Europol as suspected and is not yet part of the U.S. charging document.
The investigation's origin point sits nine months earlier and a thousand miles west. In September 2025, Polish Police arrested a Ukrainian national linked to AudiA6, and forensic analysis of seized devices identified additional suspects. What followed is now visible as a cross-border enforcement template: Polish intelligence seeded the case, Georgian authorities executed the field arrests, Europol coordinated the action alongside Eurojust, and the U.S. Department of Justice for the Eastern District of Pennsylvania filed the federal charges. Tkachuk and Ledenev each face one count of conspiracy to launder monetary instruments and one count of sting money laundering, carrying a maximum of 20 years per count if convicted.
The seizure banner now greeting visitors to the former AudiA6 domains, replacing both clear-web and dark-web sites, is the public marker of the takedown. It is the visual that The Hacker News and other security outlets circulated the morning after. Europol links the service to more than 15 active investigations worldwide involving ransomware attacks and large-scale cryptocurrency theft. The €692,000 in frozen crypto and the additional €86,000 in seized cryptocurrency are a fraction of the €336 million total; the bulk of laundered value has long since moved through the pipeline the operation is now dismantling.
What the case adds to the field is a stress test, not a resolution. The platform operated openly for roughly five years before coordinated action reached it. The 3-to-10 percent commission, the one-hour settlement window, and the 6,000-record KYC-fraud supply chain describe an industrial mixer with a repeatable template, not a one-off shop. The next question is whether the gap gets filled by a successor service with a new name and the same stolen-identity inputs. That question, more than the €336 million figure, is what determines whether the headline represents a past total or a current rate.