A world legislation enforcement operation amongst 11 nations has shut down AudiA6, a cash laundering ring that processed over 336 million euros ($390 million) in illicit funds between 2022 and 2025.
On Wednesday, authorities arrested two directors, Russian and Ukrainian nationals, in Georgia, seized 25 domains and greater than 30 servers and 80 autos and froze roughly $900,000 in cryptocurrency, the European Union Company for Legal Justice Cooperation (Eurojust) said Thursday.
The AudiA6 “mixer-as-a-service” was utilized by cybercriminals concerned in ransomware assaults to money out stolen crypto and conceal the motion of illicit funds from authorities by providing to “clear” crypto inside about an hour for a 3% to 10% fee.
Since 2021, AudiA6 wallets acquired roughly 10,333 BTC, valued at round $389 million on the time the transactions occurred, Chainalysis reported.
The cybercrime syndicate behind the service can also be reportedly operating a separate market discussion board generally known as “Dark2Web”, which is used to promote illicit providers and join cybercriminals worldwide, in accordance with Eurojust.
The investigation concerned companies from america, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the UK, coordinated by way of Eurojust and Europol.
Faux KYC accounts utilized in scheme
The crypto laundering ring was facilitated by hundreds of fraudulent accounts utilizing stolen or bought identities.
Greater than 6,000 Know Your Buyer (KYC) data linked to “cash mule accounts” have been recognized in the course of the investigation, Eurojust stated.
A lot of these accounts have been linked to Russian-speaking intermediaries recruited particularly to assist transfer felony proceeds by way of crypto exchanges, it added.
Associated: Ransomware assaults surge 50% in 2025, ransom funds decline
AudiA6 additionally reportedly laundered a part of a ransom paid by an Australian enterprise in 2024 following a ransomware extortion assault, accordingly to the Australian Federal Police, which was a part of the investigation.
Each the common and darkish internet variations of AudiA6 and Dark2Web domains have been changed with seizure banners.
A multinational legislation enforcement effort led to the closure of the platforms. Supply: Europol
Ransomware consolidates round just a few operators
Ransomware was recorded in 97 nations in the course of the first quarter of 2026, however the distribution of assaults is changing into more and more concentrated, with the US accounting for 64.7% of all recorded victims, accordingly it Emsisoft.
“The ransomware ecosystem is as soon as once more consolidating round fewer, extra dominant operators,” with the highest 10 ransomware teams accounting for 71% of all Q1 2026 victims, reported Test Level Analysis in Might.
Journal: Does ‘Paper Bitcoin’ mean there’s an unlimited supply of BTC?
