Union

2024

United

2026

An international law enforcement operation among 11 countries has shut down AudiA6, a money laundering ring that processed over 336 million euros ($390 million) in illicit funds between 2022 and 2025.
On Wednesday, authorities arrested two administrators, Russian and Ukrainian nationals, in Georgia, seized 25 domains and more than 30 servers and 80 vehicles and froze roughly $900,000 in cryptocurrency, the European Union Agency for Criminal Justice Cooperation (Eurojust) <a href="https://www.eurojust.europa.eu/news/cryptocurrency-money-laundering-site-shut-down-thanks-coordinated-investigation" rel="noopener noreferrer nofollow">said</a> Thursday.
The AudiA6 “mixer-as-a-service” was used by cybercriminals involved in ransomware attacks to cash out stolen crypto and conceal the movement of illicit funds from authorities by offering to “clean” crypto within about an hour for a 3% to 10% commission.
Since 2021, AudiA6 wallets received approximately 10,333 BTC, valued at around $389 million at the time the transactions occurred, Chainalysis <a href="https://www.chainalysis.com/blog/law-enforcement-dismantles-audia6-laundering-network-june-2026/" rel="noopener noreferrer nofollow">reported</a>.&nbsp;
The cybercrime syndicate behind the service is also reportedly running a separate marketplace forum known as “Dark2Web”, which is used to advertise illicit services and connect <a href="https://cointelegraph.com/news/ukraine-arrests-suspect-100m-cybercrime-ring-11m-seized-crypto" rel="noopener noreferrer nofollow">cybercriminals</a> worldwide, according to Eurojust.&nbsp;
The investigation involved agencies from the United States, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the United Kingdom, coordinated through Eurojust and Europol.&nbsp;
<h2 id="fake-kyc-accounts-used-in-scheme">Fake KYC accounts used in scheme</h2>
The crypto laundering ring was facilitated by thousands of fraudulent accounts using stolen or purchased identities.&nbsp;
More than 6,000 <a href="https://cointelegraph.com/news/ai-cybercrime-tool-crypto-bank-kyc-deepfakes" rel="noopener noreferrer nofollow">Know Your Customer</a> (KYC) records linked to “money mule accounts” were identified during the investigation, Eurojust said.&nbsp;
Many of those accounts were connected to Russian-speaking intermediaries recruited specifically to help move criminal proceeds through crypto exchanges, it added.&nbsp;
Related: <a href="https://cointelegraph.com/news/ransomware-attacks-rose-50-in-2025-chainalysis" rel="noopener noreferrer nofollow">Ransomware attacks surge 50% in 2025, ransom payments decline</a>
AudiA6 also reportedly laundered part of a ransom paid by an Australian business in 2024 following a ransomware extortion attack, <a href="https://www.afp.gov.au/news-centre/media-release/afp-assists-europol-disruption-542-million-money-laundering-operation" rel="noopener noreferrer nofollow">according</a> to the Australian Federal Police, which was part of the investigation.&nbsp;
Both the regular and dark web versions of AudiA6 and Dark2Web domains have been replaced with seizure banners.
<img alt="International sting shuts down $390M crypto money-laundering ring" height="1091" src="https://s3-images.ctmedia.io/media/content/pasted-image-297.jpeg" width="1940">A multinational law enforcement effort led to the closure of the platforms. Source:<a href="https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline" rel="noopener noreferrer nofollow">Europol</a>
<h2 id="ransomware-consolidates-around-a-few-operators">Ransomware consolidates around a few operators&nbsp;&nbsp;</h2>
Ransomware was recorded in 97 countries during the first quarter of 2026, but the distribution of attacks is becoming increasingly concentrated, with the US accounting for 64.7% of all recorded victims, <a href="https://www.emsisoft.com/en/blog/47562/the-state-of-ransomware-in-q1-2026/" rel="noopener noreferrer nofollow">according</a> to Emsisoft.&nbsp;
“The ransomware ecosystem is once again consolidating around fewer, more dominant operators,” with the top 10 ransomware groups accounting for 71% of all Q1 2026 victims, <a href="https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/" rel="noopener noreferrer nofollow">reported</a> Check Point Research in May.&nbsp;
Magazine: <a href="https://cointelegraph-magazine.com/does-paper-bitcoin-mean-theres-an-unlimited-supply-of-btc/" rel="noopener noreferrer nofollow">Does ‘Paper Bitcoin’ mean there’s an unlimited supply of BTC?</a>

International sting shuts down $390M crypto money-laundering ring

Table of Contents

Cointelegraph

Other articles published on Jun 12, 2026

Join our free newsletter for daily crypto updates!