A major international operation has led to the complete shutdown of a cryptocurrency laundering service, AudiA6, and the arrest of its operators in Batumi, Georgia. This development results from a large-scale joint investigation by the US Secret Service Cyber Investigative Section and the IRS Criminal Investigation (IRS-CI).

The two individuals arrested have been identified as 37-year-old Ukrainian national Ruslan Igorevich Tkachuk and 25-year-old Russian Alexander Vladimirovich Ledenev.

A criminal complaint has been filed against them in the Eastern District of Pennsylvania, in which they are charged with conspiring to launder monetary instruments and to commit money laundering. Both the accused, who are currently in a Georgian jail awaiting extradition, face up to 20 years in prison if convicted.

Uncovering the AudiA6 Operation

The criminal complaint alleges that Tkachuk and Ledenev were senior members of the AudiA6 organisation. They managed the money laundering service alongside an illegal forum called Dark2Web, where they actively advertised their capabilities. AudiA6 promised to conceal and disguise the origin of traceable cryptocurrency for a fee of up to five percent.

Federal investigators used blockchain analysis tools to audit the network’s financial records. They discovered that approximately 10,333 Bitcoin (worth roughly $389,747,417 at the time) were received in AudiA6 wallets since its launch in 2021.

Further research revealed that 393.39 BTC (worth around $19,234,331) came directly from ransomware organisations, dark web markets, and similar other cybercrime platforms. Additional illicit funds were routed indirectly into the platform to blend with clean transactions.

Seizure of the Criminal Setup

The joint action simultaneously targeted the group’s physical and digital assets. Personnel searched three properties and seized digital devices. They blocked active Telegram accounts used by the network and froze remaining cryptocurrency assets.

Furthermore, federal agents took control of the criminal operation by seizing servers and domains located in the United States, Iceland, Germany, and France. Both the clear web and dark web sites for AudiA6 and Dark2Web have been taken offline and replaced with a law enforcement seizure banner.

This operation also involved support from Europol, Eurojust, and law enforcement authorities from Australia, Canada, France, Germany, Iceland, Japan, Poland, and Switzerland.

According to Europol’s press release, the AudiA6 group used both commercial email providers and email addresses linked to domains under its control to register money mule accounts with cryptocurrency exchanges.

Authorities have made the domains public so exchanges can identify and block accounts associated with the laundering service. The listed domains include the following addresses:

smplfy.in
lett.email
trayo.app
pheontx.eu
mailora.eu
qube.black
postfast.eu
postino.click
quix.express
postify.email
deliverly.top
inboxly.top
flowcomm.click
lettermail.eu
deliverlett.com
designli.pictures
sumato-soft.org
technobrains.dev
inboxally.agency.