Summary
Europol has announced the takedown of “AudiA6,” a professional cryptocurrency laundering operation that processed over €336 million in illicit profits for ransomware gangs and cybercriminal networks between 2022 and 2025. The coordinated operation on June 10, 2026, resulted in the arrest of two alleged administrators — a 37-year-old Ukrainian national and a 25-year-old Russian national — in Georgia.
The AudiA6 service operated as a mixing and laundering platform advertised on underground cybercrime forums, taking a 3–10% commission to “clean” stolen cryptocurrency through complex transaction chains. Investigators uncovered more than 6,000 fraudulent KYC records using stolen identities to facilitate the laundering. The operation yielded 25 domain seizures, 30+ servers taken offline, 80+ vehicles confiscated, and approximately €692,000 in cryptocurrency frozen.
The U.S. Department of Justice has filed conspiracy charges against the arrested administrators. Europol linked the service to more than 15 international cybercrime investigations, and the operators are also suspected of running the “Dark2Web” cybercrime forum.
Source
Europol Official Press Release · The Hacker News · Help Net Security
Commentary
This is the second major law enforcement takedown in a week, following Operation Saffron’s dismantling of a criminal VPN network. Crypto laundering services like AudiA6 are critical infrastructure for the ransomware economy — without reliable cash-out channels, the entire extortion model becomes less viable. The scale here (€336M over three years) shows how industrialized this pipeline has become.
The use of 6,000+ stolen KYC records is particularly concerning, highlighting how identity theft feeds directly into the ransomware supply chain. The fact that the operators also allegedly ran a dark web forum suggests these weren’t just launderers — they were central nodes in the cybercrime ecosystem. Expect further arrests as international partners follow the seized server data.