Global Law Enforcement Takedown of Ransomware Laundering Pipeline AudiA6

An international law enforcement operation has dismantled AudiA6, a cryptocurrency laundering service that processed EUR 336 million for ransomware gangs. The service was linked to more than 15 international cybercrime investigations, including stolen proceeds from the 2022 LastPass breach and the Swissborg hack.

The operation involved Europol and prosecutors in the Eastern District of Pennsylvania, who charged Igorevich Tkachuk, 37, of Ukraine, and Alexander Vladimirovich Ledenev, 25, of Russia, with operating AudiA6. The defendants were arrested this week in Batumi, Georgia.

AudiA6 operated Dark2Web, a cybercrime forum where users paid to commission crimes against specific targets. In undercover transactions, federal agents documented operators actively soliciting dirty funds and knowingly confirming the criminal origin of proceeds.

TRM data shows that ransomware groups routed between 42% and 57% of their off-ramp volume through just five services annually. The top five services alone account for between 42% and 57% of total off-ramp volume annually, with a concentration pattern that persisted through multiple enforcement cycles.

The shift from mixers to cross-chain bridges has also been noted in ransomware laundering. Bridge flows reached USD 100 million in 2025, more than double 2021 levels, and for the first time, bridge volumes were higher than mixer volumes for the year.