Law enforcement agencies from 11 countries across Europe, the Americas, and Asia have dismantled a cryptocurrency laundering platform known as “AudiA6,” arresting two men believed to have administered a service allegedly used to clean more than $380 million in criminal proceeds between 2022 and 2025. The operation was coordinated with support from Europol and Eurojust.
The two suspects — Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national — were taken into custody by Georgian authorities and now face sentences of up to 20 years in prison on charges related to facilitating cybercrime laundering operations. The U.S. Department of Justice identified both men as senior members of the AudiA6 platform.
AudiA6 marketed itself as a professional cryptocurrency mixing service. Investigators allege the platform accepted proceeds from cybercrime, routed funds through complex transaction chains designed to obscure their origins, and returned cleaned funds to clients within roughly an hour, charging a commission of between 3 and 10 percent. Europol described the operation as an industrial-scale laundering hub that investigators have linked to more than 15 separate international investigations involving ransomware attacks and large-scale cryptocurrency theft.
The DOJ stated that of approximately 10,333 bitcoin deposited into the service, roughly 393.39 BTC — valued at approximately $19.2 million at the time of the transactions — was received directly from known darknet markets, ransomware organizations, cybercrime services, and other illicit sources. Additional funds were deposited indirectly from illicit sources into AudiA6 wallets.
To move money through the system, investigators allege the platform relied on a sprawling network of fraudulent exchange accounts opened using stolen or purchased identities. Europol said many of those accounts were linked to Russian-speaking intermediaries who recruited individuals specifically to serve as money mules. The operation recovered approximately 6,000 Know-Your-Customer records tied to those mule accounts, and Europol published associated domain information to help cryptocurrency exchanges identify and block them.
The investigation’s breakthrough came in September 2025, when Polish authorities arrested a Ukrainian national linked to AudiA6. Forensic analysis of that suspect’s devices allowed investigators to identify key figures behind the operation and ultimately locate Tkachuk and Ledenev in Georgia.
Tkachuk and Ledenev are also alleged to have administered “Dark2Web,” an underground forum that cybercriminals used to advertise illicit services. Seizure notices now appear on both the AudiA6 and Dark2Web websites.
Prior to the law enforcement action, the platform had been flagged publicly by cybersecurity intelligence firm Intel471 and blockchain investigator ZachXBT as a facilitator of illegal activity.
