International operation dismantles AudiA6 crypto mixer, arrests two administrators
In brief
- AudiA6 cryptocurrency mixer dismantled across 11 countries in coordinated law enforcement operation since 2021
- Two administrators (Russian and Ukrainian nationals) arrested in Georgia; servers, domains, and $900,000 in crypto seized
- AudiA6 processed 336 million euros ($390 million) in illicit funds using mixer-as-a-service model between 2022–2025
- Operation identified 6,000+ KYC records linked to money mule accounts and ransomware attack connections
The Operation
An international law enforcement operation among 11 countries shut down AudiA6, a money laundering ring that processed over 336 million euros in illicit funds between 2022 and 2025. The investigation involved agencies from the United States, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland, and the United Kingdom, coordinated through Eurojust and Europol.
Authorities arrested two administrators, Russian and Ukrainian nationals, in Georgia on Wednesday. The operation seized 25 domains and more than 30 servers, 80 vehicles, and froze roughly $900,000 in cryptocurrency.
How AudiA6 Operated
The AudiA6 "mixer-as-a-service" was used by cybercriminals involved in ransomware attacks to cash out stolen crypto and conceal the movement of illicit funds from authorities by offering to "clean" crypto within about an hour for a 3% to 10% commission. Since 2021, AudiA6 wallets received approximately 10,333 BTC, valued at around $389 million at the time the transactions occurred.
The cybercrime syndicate behind AudiA6 was also running a separate marketplace forum known as Dark2Web, used to advertise illicit services and connect cybercriminals worldwide. More than 6,000 Know Your Customer records linked to "money mule accounts" were identified during the investigation. Many of those accounts were connected to Russian-speaking intermediaries recruited specifically to help move criminal proceeds through crypto exchanges.
Real-World Impact
AudiA6 also reportedly laundered part of a ransom paid by an Australian business in 2024 following a ransomware extortion attack. The takedown demonstrates how law enforcement agencies are increasingly coordinating across borders to disrupt crypto-enabled crime networks and trace illicit fund flows through blockchain infrastructure.
