Europol Seizes 30+ Servers, Arrests Tkachuk and Ledenev in AudiA6 €336M Laundering Takedown
AudiA6's infrastructure relied on identity fraud and mule networks rather than novel cryptography. The Polish-to-Georgian investigative chain demonstrates how single-arrest forensics now scales to multi-jurisdictional mixer dismantlements. Continued pressure will force ransomware operators toward self-hosted or non-custodial alternatives.
The operation followed a September 2025 Polish arrest that yielded device forensics identifying the two suspects and their Dark2Web forum administration. DOJ filings show 393 BTC flowed directly from ransomware and darknet markets into AudiA6 wallets, with the service using thousands of stolen-identity exchange accounts and Russian-speaking mules to break transaction chains within one hour at 3-10% fees. More than 6000 KYC mule records were recovered, exposing an industrial pipeline that supported at least 15 global ransomware cases. Independent blockchain tracing confirms the €336 million volume but attributes only the direct deposits; official claims of total laundering lack full graph attribution beyond the 393 BTC slice. This pattern matches prior mixers like ChipMixer and Tornado Cash where mule-account reuse created persistent clustering despite rotation. Seizure of Telegram accounts and replacement banners on both clearnet and darknet sites signals a shift from takedown to persistent disruption. Next indicators include whether remaining mule clusters re-emerge on new domains or migrate to privacy-focused chains within 60 days.
Europol: At least two additional Dark2Web-linked administrators arrested or assets frozen in Georgia or Ukraine within 90 days
Sources (2)
- [1]Primary Source(https://www.europol.europa.eu/media-press/newsroom/news/europol-disrupts-audia6-crypto-laundering-service)
- [2]Supporting Source(https://www.justice.gov/opa/pr/two-russian-nationals-charged-conspiracy-launder-monetary-instruments-and-money-laundering)