Authorities Seize AudiA6 Crypto Laundering Service Used by Cybercriminal Gangs

Authorities have dismantled a major cryptocurrency laundering infrastructure known as “AudiA6,” disrupting a critical financial backbone used by ransomware gangs and cybercriminal networks to legitimize illicit proceeds.

The coordinated international operation, supported by Europol and Eurojust, targeted a service believed to have laundered more than EUR 336 million between 2022 and 2025, marking one of the most significant crackdowns on crypto-based money laundering to date.

Authorities Seize AudiA6 Crypto Laundering Service

The enforcement action, conducted on June 10, involved agencies including the United States Secret Service, IRS Criminal Investigation, and Polish law enforcement, as well as multiple global partners.

Authorities arrested two alleged operators of Ukrainian and Russian nationalities in Georgia, while simultaneously seizing more than 30 servers, taking down 25 domains, and confiscating over 80 vehicles and multiple properties.

Additionally, approximately EUR 692,000 in cryptocurrency was frozen, and more than EUR 86,000 was seized. Telegram accounts associated with the network were also blocked, and both clear web and dark web infrastructure tied to AudiA6 and the affiliated “Dark2Web” cybercrime forum were replaced with law enforcement seizure banners.

Investigators revealed that AudiA6 operated as a professional “crypto cleaning” service, widely advertised across underground forums. The platform enabled cybercriminals to obscure the origin of stolen cryptocurrency through rapid transaction layering and chain-hopping techniques.

After transferring illicit funds to wallets controlled by the group, users would receive “cleaned” assets within approximately one hour, with service fees ranging from 3% to 10%.

Europol analysis linked the laundering service to more than 15 international cybercrime investigations, including ransomware campaigns and large-scale cryptocurrency theft operations.

The infrastructure relied heavily on thousands of fraudulent exchange accounts created using stolen or purchased identities. Authorities identified more than 6,000 Know Your Customer (KYC) records tied to money mule networks, many of which were facilitated by Russian-speaking intermediaries.

These mule accounts were registered using a mix of commercial email services and attacker-controlled domains, several of which have now been publicly disclosed to aid detection and prevention efforts.

Notable domains include designli.pictures, pheontx.eu, smplfy.in, sumato-soft.org, technobrains.dev, and inboxally.agency, among others.

Earlier investigative breakthroughs by Polish authorities in September 2025, including the arrest of a key suspect and forensic analysis of seized devices, played a pivotal role in identifying additional members of the laundering network.

Europol’s European Cybercrime Center (EC3) further supported the operation by tracing illicit cryptocurrency flows, mapping laundering infrastructure, and facilitating real-time intelligence sharing during coordinated enforcement actions.

The takedown highlights the growing industrialization of cryptocurrency laundering services, a trend emphasized in Europol’s 2026 Internet Organized Crime Threat Assessment (IOCTA).

Cybercriminal groups increasingly leverage mixer-as-a-service platforms, decentralized exchanges, and cross-chain obfuscation techniques to evade detection.

The AudiA6 disruption represents a significant blow to the cybercrime economy. However, authorities warn that the rapid evolution of laundering methodologies continues to pose a persistent challenge for global law enforcement.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.