International sting shuts down AudiA6’s $390 million crypto laundering network

An international law enforcement operation involving 11 countries has shut down AudiA6, a “mixer-as-a-service” used to clean ransomware proceeds and other illicit crypto flows. For PSPs and crypto businesses, the useful detail is not the headline arrest count; it is the scale, the KYC abuse, and the way laundering infrastructure now sits one layer away from exchanges and payment rails.

1. Authorities say AudiA6 processed more than 336 million euros ($390 million) in illicit funds between 2022 and 2025. On Wednesday, investigators arrested two administrators, Russian and Ukrainian nationals, in Georgia, and seized 25 domains, more than 30 servers, 80 vehicles, and roughly $900,000 in cryptocurrency, according to Eurojust on Thursday.
2. The service was marketed as a fast crypto-cleaning tool: cybercriminals could use it to hide the movement of stolen funds and cash out ransomware proceeds in about an hour, paying a 3% to 10% commission. In practice, that makes it the kind of plumbing compliance teams care about, because the customer-facing exchange or on-ramp often only sees the end of the chain.
3. Chainalysis said AudiA6 wallets received approximately 10,333 BTC since 2021, worth around $389 million at the time the transactions occurred. Eurojust also said the syndicate behind the service is reportedly running a separate marketplace forum called “Dark2Web,” used to advertise illicit services and connect cybercriminals worldwide.
4. The investigation involved agencies from the United States, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the United Kingdom, coordinated through Eurojust and Europol. Authorities also said the scheme relied on thousands of fraudulent accounts, with more than 6,000 Know Your Customer (KYC) records linked to “money mule accounts” identified during the investigation.
5. Eurojust said many of those accounts were connected to Russian-speaking intermediaries recruited specifically to move criminal proceeds through crypto exchanges. The Australian Federal Police, also part of the case, said AudiA6 laundered part of a ransom paid by an Australian business in 2024 after a ransomware extortion attack.

For high-risk payment and crypto businesses, the takeaway is simple: large-scale laundering now depends on identity fraud, mule networks, and exchange access, not just wallets and mixers. That means the pressure point keeps shifting toward KYC quality, account provenance, and how quickly a provider can spot patterns before they become a law-enforcement headline.