A world legislation enforcement operation amongst 11 nations has shut down AudiA6, a cash laundering ring that processed over 336 million euros ($390 million) in illicit funds between 2022 and 2025.
On Wednesday, authorities arrested two directors, Russian and Ukrainian nationals, in Georgia, seized 25 domains and greater than 30 servers and 80 autos and froze roughly $900,000 in cryptocurrency, the European Union Company for Legal Justice Cooperation (Eurojust) said Thursday.
The AudiA6 “mixer-as-a-service” was utilized by cybercriminals concerned in ransomware assaults to money out stolen crypto and conceal the motion of illicit funds from authorities by providing to “clear” crypto inside about an hour for a 3% to 10% fee.
Since 2021, AudiA6 wallets obtained roughly 10,333 BTC, valued at round $389 million on the time the transactions occurred, Chainalysis reported.
The cybercrime syndicate behind the service can also be reportedly operating a separate market discussion board referred to as “Dark2Web”, which is used to promote illicit providers and join cybercriminals worldwide, in accordance with Eurojust.
The investigation concerned companies from the US, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the UK, coordinated by means of Eurojust and Europol.
Pretend KYC accounts utilized in scheme
The crypto laundering ring was facilitated by hundreds of fraudulent accounts utilizing stolen or bought identities.
Greater than 6,000 Know Your Customer (KYC) data linked to “cash mule accounts” had been recognized in the course of the investigation, Eurojust stated.
A lot of these accounts had been linked to Russian-speaking intermediaries recruited particularly to assist transfer legal proceeds by means of crypto exchanges, it added.
Associated: Ransomware attacks surge 50% in 2025, ransom payments decline
AudiA6 additionally reportedly laundered a part of a ransom paid by an Australian enterprise in 2024 following a ransomware extortion assault, according to the Australian Federal Police, which was a part of the investigation.
Each the common and darkish internet variations of AudiA6 and Dark2Web domains have been changed with seizure banners.
A multinational legislation enforcement effort led to the closure of the platforms. Supply: Europol
Ransomware consolidates round a number of operators
Ransomware was recorded in 97 nations in the course of the first quarter of 2026, however the distribution of assaults is changing into more and more concentrated, with the US accounting for 64.7% of all recorded victims, according to Emsisoft.
“The ransomware ecosystem is as soon as once more consolidating round fewer, extra dominant operators,” with the highest 10 ransomware teams accounting for 71% of all Q1 2026 victims, reported Verify Level Analysis in Could.
Journal: Does ‘Paper Bitcoin’ mean there’s an unlimited supply of BTC?
