$390 Million Crypto Laundering Ring Busted — Here’s How Police Took It Down

TLDR

• Eleven countries joined forces to dismantle AudiA6, a crypto laundering network linked to ransomware gangs
• The network processed around 10,333 BTC, historically valued at roughly $389 million, since 2021
• Two administrators — a Ukrainian and a Russian national — were arrested in Georgia; the US is seeking extradition
• AudiA6 used over 6,000 fake KYC-verified accounts to move dirty funds through legitimate crypto exchanges
• The connected Dark2Web marketplace, used to advertise criminal services, was also seized

Law enforcement across 11 countries has shut down AudiA6, a cryptocurrency laundering network that processed around $390 million in illicit funds over four years. The operation also took down Dark2Web, a darknet forum tied to the same criminal group.

Authorities arrested two suspected administrators in the Republic of Georgia — a 37-year-old Ukrainian national and a 25-year-old Russian national. The US Department of Justice is seeking their extradition.

The action was coordinated through Eurojust and Europol, with agencies from the US, Australia, France, Germany, the UK, Canada, Japan, Switzerland, Iceland, Poland, and Georgia all taking part.

How AudiA6 Worked

AudiA6 operated as a “mixer-as-a-service.” It took in dirty cryptocurrency from ransomware gangs and other cybercriminals and returned cleaner funds — usually within an hour — for a commission of between 3% and 10%.

Blockchain analytics firm Chainalysis said the network handled approximately 10,333 Bitcoin since launching in 2021, historically valued at around $389 million.

Investigators traced at least 393 BTC — worth more than $19 million — directly from known ransomware actors and darknet markets. More than $16 million tied specifically to ransomware and stolen funds was laundered through the service.

The network exploited legitimate crypto exchanges by routing funds through over 6,000 fake KYC-verified accounts. These “money mule” accounts had passed identity checks, making the illicit activity harder to detect.

Chainalysis also linked AudiA6’s cash-out pipeline to sanctioned Russian exchanges, including Bitzlato and Garantex, and to Exploit.in, a Russian-language cybercrime forum.

Dark2Web Also Seized

Alongside AudiA6, authorities shut down Dark2Web — a marketplace forum used to connect cybercriminals and advertise illicit services globally.

Both the regular and dark web versions of the platforms have been replaced with law enforcement seizure banners. Twenty-five domains, more than 30 servers, and 80 vehicles were seized. Around $900,000 in cryptocurrency was frozen.

AudiA6 also reportedly laundered part of a ransom paid by an Australian business following a 2024 ransomware attack, according to the Australian Federal Police.

The takedown comes as ransomware activity continues at a high pace. Ransomware was recorded in 97 countries in the first quarter of 2026. The US accounted for 64.7% of all recorded victims, according to Emsisoft.

Check Point Research reported in May that the top 10 ransomware groups were responsible for 71% of all victims in Q1 2026, showing that the ecosystem is consolidating around fewer but more active operators.

The AudiA6 case shows that law enforcement is now targeting the full cash-out infrastructure behind cybercrime — not just the attacks themselves.

Investigators used blockchain analytics to trace transaction patterns, link wallets to real-world operators, and connect exchange accounts to criminal networks — a method that is becoming standard in crypto-related enforcement actions.

The post $390 Million Crypto Laundering Ring Busted — Here’s How Police Took It Down appeared first on CoinCentral.