GoKawiilLaw enforcement has dismantled the “AudiA6” cryptocurrency service allegedly used by ransomware actors and other cybercriminals to launder more than $380 million.
Europol says that the service has been linked to more than 15 distinct international investigations of ransomware attacks.
It is believed that the platform acted as a central money laundering hub between 2022 and 2025.
“Investigators uncovered what they describe as an industrial-scale cryptocurrency laundering operation built around thousands of fraudulent exchange accounts opened using stolen or purchased identities,” describes Europol says.
“Analysis conducted by Europol linked the criminal service to more than 15 investigations worldwide involving ransomware attacks and large-scale cryptocurrency theft.”
The service was marketed as a “professional cryptocurrency mixing service,” but all it did was accept cybercrime proceeds, move the money around through complex transaction routes that obscured its origin, and return it “cleaned” to the holders in about an hour, minus a 3-10% service commission.
Past reports from Intel471 and blockchain investigator ZachXBT exposed AudiA6 for facilitating illegal activity.
The investigation involved authorities from 11 countries across Europe, America, and Asia, who were supported by Europol and Eurojust.
Europol states that the action was possible due to the arrest in Poland in September 2025 of a Ukrainian national linked to AudiA6.
The forensic examination of the suspect’s devices helped investigators identify key individuals behind the operation and eventually locate and arrest them in Georgia.
... continue reading