International sting shuts down $390M crypto money-laundering ring
Authorities in 11 countries dismantled the AudiA6 mixer service that laundered over $390M in crypto for ransomware gangs, seizing domains, servers, and freezing funds. The operation disrupted a major illicit finance pipeline and uncovered thousands of fraudulent KYC accounts.
Quick Take
AudiA6 laundered ~$390M through 10,333 BTC for ransomware criminals since 2021
Two admins arrested, 25 domains and 30 servers seized, $900K in crypto frozen
Investigation spanned 11 countries, coordinated by Eurojust and Europol
Over 6,000 fake KYC accounts linked to money mule intermediaries identified
Market Impact Analysis
BullishDisrupting large-scale crypto crime enhances the ecosystem's legitimacy and could encourage institutional adoption, though regulatory overreach fears persist.
Speculation Analysis
Key Takeaways
- AudiA6 laundered $390M through 10,333 BTC for ransomware gangs since 2021
- Two administrators arrested, 25 domains and 30 servers seized, $900K in crypto frozen
- Investigation spanned 11 countries, coordinated by Eurojust and Europol
- Over 6,000 fake KYC accounts linked to money mule intermediaries identified
What Happened
An international sting dismantled AudiA6, a crypto mixer service that laundered more than $390 million for ransomware criminals. Eurojust announced that authorities arrested two administrators—Russian and Ukrainian nationals—in Georgia. The operation seized 25 domains, over 30 servers, and 80 vehicles, while freezing approximately $900,000 in cryptocurrency. AudiA6 offered "mixer-as-a-service" capabilities, cleaning illicit funds within an hour for a 3% to 10% commission. The platform also operated Dark2Web, a dark web forum advertising criminal services. AudiA6 laundered part of a ransom paid by an Australian business in 2024. The takedown involved agencies from 11 countries, including the U.S., Australia, and several European nations, coordinated through Eurojust and Europol.
The Numbers
Between 2022 and 2025, AudiA6 processed €336 million—roughly $390 million—in illicit transactions. Chainalysis data shows its wallets received approximately 10,333 BTC since 2021, valued at $389 million at the time of transfer. Authorities seized 25 domains, more than 30 servers, and 80 vehicles. Around $900,000 in crypto was frozen. Investigators also uncovered over 6,000 fraudulent KYC records tied to money mule accounts, many linked to Russian-speaking intermediaries recruited to move criminal proceeds through exchanges. The service typically charged a 3% to 10% commission for mixing, with transactions completed in about an hour.
Why It Happened
The platform flourished as ransomware groups needed a fast, reliable way to obfuscate stolen crypto. AudiA6’s model—mixing funds with a 3-10% cut and fake KYC accounts—made it an attractive conduit. The separate dark web forum Dark2Web further connected criminals. However, blockchain forensics enabled authorities to trace transactions, and international cooperation allowed a coordinated strike. The ransomware ecosystem is consolidating around fewer, more dominant operators, making high-profile targets like AudiA6 a priority for takedowns.
Broader Impact
Shutting down a major mixer like AudiA6 signals that crypto crime can be effectively targeted globally. This may bolster crypto’s legitimacy, easing institutional concerns. However, it could also push illicit activity toward smaller, harder-to-track services. The operation demonstrates the growing ability of authorities to follow on-chain money trails, a trend that could deter some ransomware operations. Previous mixer takedowns have led to temporary declines in ransomware, but longer-term effects remain uncertain.
What to Watch Next
- Emergence of replacement mixer services and Dark2Web clones
- Potential further arrests or seizures linked to the AudiA6 network
- Impact on ransomware payment volumes and cybercriminal behavior
This article is for informational purposes only and does not constitute financial advice.
Always late to trends?
Join for the latest news, insights & more.
Disclaimer: Bytewit is an independent media outlet that delivers news, research, and data.
© 2026 Bytewit. All Rights Reserved. This article is for informational purposes only.
