A global legislation enforcement operation amongst 11 international locations has shut down AudiA6, a cash laundering ring that processed over 336 million euros ($390 million) in illicit funds between 2022 and 2025.
On Wednesday, authorities arrested two directors, Russian and Ukrainian nationals, in Georgia, seized 25 domains and greater than 30 servers and 80 automobiles and froze roughly $900,000 in cryptocurrency, the European Union Company for Prison Justice Cooperation (Eurojust) mentioned Thursday.
The AudiA6 “mixer-as-a-service” was utilized by cybercriminals concerned in ransomware assaults to money out stolen crypto and conceal the motion of illicit funds from authorities by providing to “clear” crypto inside about an hour for a 3% to 10% fee.
Since 2021, AudiA6 wallets acquired roughly 10,333 BTC, valued at round $389 million on the time the transactions occurred, Chainalysis reported.
The cybercrime syndicate behind the service can also be reportedly working a separate market discussion board generally known as “Dark2Web”, which is used to promote illicit providers and join cybercriminals worldwide, in accordance with Eurojust.
The investigation concerned companies from the USA, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the UK, coordinated by means of Eurojust and Europol.
Pretend KYC accounts utilized in scheme
The crypto laundering ring was facilitated by 1000’s of fraudulent accounts utilizing stolen or bought identities.
Greater than 6,000 Know Your Buyer (KYC) data linked to “cash mule accounts” have been recognized through the investigation, Eurojust mentioned.
Lots of these accounts have been linked to Russian-speaking intermediaries recruited particularly to assist transfer legal proceeds by means of crypto exchanges, it added.
Associated: Ransomware assaults surge 50% in 2025, ransom funds decline
AudiA6 additionally reportedly laundered a part of a ransom paid by an Australian enterprise in 2024 following a ransomware extortion assault, in accordance to the Australian Federal Police, which was a part of the investigation.
Each the common and darkish net variations of AudiA6 and Dark2Web domains have been changed with seizure banners.
A multinational legislation enforcement effort led to the closure of the platforms. Supply: Europol
Ransomware consolidates round a couple of operators
Ransomware was recorded in 97 international locations through the first quarter of 2026, however the distribution of assaults is turning into more and more concentrated, with the US accounting for 64.7% of all recorded victims, in accordance to Emsisoft.
“The ransomware ecosystem is as soon as once more consolidating round fewer, extra dominant operators,” with the highest 10 ransomware teams accounting for 71% of all Q1 2026 victims, reported Verify Level Analysis in Might.
Journal: Does ‘Paper Bitcoin’ imply there’s an infinite provide of BTC?
