$389M Crypto Laundering Bust
U.S. Prosecutors Charge Two Operators with Laundering $389 Million Using Crypto Service AudiA6
Key Points
Prosecutors said the defendants are a 37-year-old Ukrainian national (Ruslan Igorevich Tkachuk) and a 25-year-old Russian national (Alexander Vladimirovich Ledenev), both detained in Batumi, Georgia; U.S. authorities are seeking their extradition to the Eastern District of Pennsylvania.
The complaint describes AudiA6’s alleged laundering method as moving illicit crypto through 'controlled wallets and transaction layers' before returning funds that appeared harder to trace—services prosecutors said were marketed via the Dark2Web forum.
Beyond seizing servers and freezing crypto, authorities also targeted AudiA6 infrastructure across multiple countries—prosecutors said they searched three properties and 'targeted servers and domains in the United States, Iceland, Germany and France'—and replaced the service’s clear-web and dark-web sites and the Dark2Web forum with law-enforcement 'seizure banners.'
One report added an extra criminal allegation not covered in the summary: prosecutors charged the defendants with 'operating an unlicensed money transmitting business' in addition to conspiracy to launder and sting money laundering.
U.S. prosecutors charged two men on June 11 with running AudiA6, a cryptocurrency laundering service that processed roughly $389 million in Bitcoin since 2021. Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national, were arrested in Batumi, Georgia, according to Decrypt. Both face up to 20 years in prison on charges of conspiracy to launder money, sting money laundering, and operating an unlicensed money transmitting business.
The Eastern District of Pennsylvania unsealed the complaints the same day a coordinated international strike took down AudiA6's websites and the Dark2Web forum where it advertised. Authorities seized servers and domains across the U.S., Iceland, Germany, and France, froze cryptocurrency assets, and replaced the service's sites with law-enforcement seizure banners, Bitcoin Magazine reported.
How AudiA6 Cleaned Nearly $400 Million in Crypto
AudiA6 launched in 2021 and quickly became a go-to service for high-level cybercriminals. It charged fees of up to 5% to move illicit crypto through layered wallets, returning funds that were harder to trace. The service promised to bring a client's AML risk score — a measure exchanges use to flag suspicious coins — below 25%, effectively slipping dirty money past compliance checks at major platforms, according to The Currency Analytics.
In total, AudiA6 received 10,333 Bitcoin, worth roughly $389 million at transaction time. Of that, 393.39 BTC — about $19 million — was traced directly to darknet markets and ransomware groups, Decrypt reported. The service advertised openly on the Dark2Web forum, targeting criminals who needed a trusted, professional-grade laundering pipeline.
Six Undercover Stings Brought the Network Down
Federal agents from the FBI, IRS-CI, and U.S. Secret Service ran six undercover operations between December 2022 and May 2026. Agents posed as criminals trying to wash proceeds from drug sales and cyber fraud. Each time, prosecutors say, AudiA6 took the bait and laundered the money. The sting operations gave prosecutors direct evidence of the service's willingness to handle known criminal proceeds.
U.S. Attorney David Metcalf framed the operation as a deliberate strategy. "We are systematically dismantling the infrastructure that allows cybercriminals to enjoy their ill-gotten gains," he said. Europol noted that AudiA6 was linked to more than 15 international cybercrime investigations, including several major ransomware attacks, according to Yahoo News.
Raids Across Four Countries Seized 80 Vehicles and 30 Servers
On June 10 — dubbed "Action Day" — authorities moved simultaneously across multiple countries. Investigators searched three properties and targeted servers and domains in the U.S., Iceland, Germany, and France. In Georgia, police seized more than 80 vehicles and multiple properties. Authorities froze €692,000 in cryptocurrency and took down 30-plus servers and 25 domains, according to Decrypt.
The operation involved partners from 10 countries, including Australia, Canada, Japan, Poland, Switzerland, and the UK, coordinated through Europol and Eurojust. Polish police had arrested a related co-conspirator as early as September 2025, feeding intelligence into the broader takedown. The Dark2Web forum — AudiA6's main advertising platform — was also seized and replaced with a law-enforcement banner, Bitcoin Magazine reported.
Extradition Sought as Crypto Industry Faces New Pressure
The U.S. has formally requested extradition of both suspects from Georgia. Legal experts expect Georgia to cooperate, given its growing ties to Western law enforcement on cybercrime cases, though the process could take months. Both men face a maximum of 20 years on each of the three charges filed against them, according to The Currency Analytics.
The case puts fresh pressure on crypto exchanges to rethink how they use AML risk scores. AudiA6 proved those scores could be gamed by sophisticated laundering techniques. Analysts also say losing a trusted cash-out service like AudiA6 may create short-term bottlenecks for ransomware groups trying to convert stolen crypto to usable funds, Decrypt noted.
Sentiment
Mostly NegativePublishers
13
Articles
8
Reach
21
