-
Two Eastern European men ran AudiA6, a crypto mixing service that laundered $389 million across five years.
-
The service openly accepted money from scams, drug sales, and ransomware, charging users transaction fees of up to 5%.
-
During the global operation, officers across 15 countries worked together to confiscate the laundering service’s servers, freeze their assets, and replace their websites with seizure banners.
Federal prosecutors in Philadelphia just charged two guys with washing nearly $400 million in dirty Bitcoin. They allegedly ran a one-stop shop for criminals to hide their digital cash.
The operation spanned five years and multiple continents. But their luck ran out when cops from over a dozen nations teamed up to shut them down.
Details of the AudiA6 Operation
A Ukrainian, Ruslan Igorevich Tkachuk, 37, and a Russian, Alexander Vladimirovich Ledenev (25) were both arrested on Wednesday in Batumi, Georgia, where they were living.
David Metcalf, US Attorney from the Eastern District of Pennsylvania, read out their charges. Each man faces 1 count of conspiracy to launder money. They also face 1 count of sting money laundering. And based on US laws, each of these charges could keep them in prison for up to twenty years.
Prosecutors say the two were top players in a criminal group known as “AudiA6.” This crew ran a cryptocurrency mixing service that helped people wash dirty money. On top of that, they controlled a cybercrime forum called Dark2Web.
There, users could strike deals for all sorts of illegal activity, everything from hiring hackers to buying stolen data and more. All of it, of course, for a price.
The Financial Trails
The numbers are enormous. Their operation (AudiA6) has brought in approximately 10,333 bitcoin since 2021. Thus, this means that they have created approximately $389.7 million worth of transactions at the time of each of these transactions.
How did they earn? They charged consumers up to 5% for transacting with them; therefore, this resulted in a minimum of 10 million dollars in commission fees alone.
While authorities crack down on money laundering, hackers affiliated with Golden Falcon have vowed cyberattacks on the US in retaliation for Iran strikes, showing the range of cyber threats facing American interests. This is very lucrative for a service that simply takes and mixes 2 or more anonymous virtual currencies together.
Where did all this dirty money come from? Through an investigation, a total of 393 bitcoins were directly traced back to known dark nets (approximately $19.2 million at that time). Ransomware groups were also responsible for depositing funds to these operations. Many other criminal groups doing cybercrime-related services also paid money into this operation.
All of these sources generated an extraordinary amount of money too. Additional amounts came from indirect criminal groups, so the overall estimated amounts of this dirty money were significantly larger than what the cops could directly trace.
The Undercover Investigation
This is where the investigators hit their jackpot. The criminal element, AudiA6, believed they provided their clients with “untraceable” transactions, but they were wrong.
By performing hard blockchain analysis, investigators were able to trace the transactions through the exchanges. Since the blockchain is unchangeable, it does not lie.
The case was partially built upon 6 undercover investigations. The undercover operations took place from Dec 2022 through May 2026 and included the FBI and Secret Service acting in the role of undercover agents.
One agent asked if stolen Bitcoin was acceptable. An AudiA6 operator simply replied, “don’t care.” No questions asked. No hesitation.
Another agent asked about drug sale proceeds. The operator worried this might be too risky. The response? “Everything like that needs to go through a mixer.” They openly welcomed drug money.
The Global Takedown
This wasn’t just America’s show. Law enforcement from 15 countries joined forces. The team included the U.S. Secret Service and IRS Criminal Investigation. Europol and Eurojust helped too.
Other partners came from Australia, Canada, France, and Georgia. Germany, Iceland, Japan, and Poland joined in. So did Switzerland and the United Kingdom. A truly global effort.
The coordinated takedown happened right after the arrests. Here’s what authorities did:
They searched three properties. Also, they seized digital devices like computers and phones. Then froze cryptocurrency assets and also blocked associated Telegram accounts.
They also targeted servers and domains in the United States, Iceland, Germany, and France. And they replaced the clear web and dark web websites of AudiA6 and Dark2Web. Visitors now see a law enforcement seizure banner instead.
The U.S. Attorney’s Office will seek the extradition of Tkachuk and Ledenev to the Eastern District of Pennsylvania. Assistant U.S. Attorneys Sima Kazmir and Benjamin D. Traster are prosecuting the case.
The Justice Department’s Office of International Affairs provided crucial support. An ICHIP prosecutor based in The Hague also helped. The U.S. Attorney’s Office for the Southern District of Ohio gave significant assistance, too.
For now, the two men remain in Georgian custody. Their $400 million washing machine is out of order. And their dark web forum now belongs to the feds.
