The DOJ complaint unsealed this week names Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25, as administrators of AudiA6, charged under 18 U.S.C. § 1956 for running a cryptocurrency mixing service Europol says processed more than $380 million in illicit funds between 2022 and 2025.
Europol describes it as “an industrial-scale cryptocurrency laundering operation built around thousands of fraudulent exchange accounts opened using stolen or purchased identities.” In practice: the platform accepted cybercrime proceeds, routed them through complex transaction chains to obscure their origin, and returned cleaned funds within roughly an hour, at a 3% to 10% commission.
Eurojust and Europol coordinated an 11-country operation across Europe, America, and Asia. The June 10 action netted two arrests in Georgia, seizure of 25 domains, 80 vehicles and properties, and the freezing of €692,000 in cryptocurrency. The service was linked to more than 15 distinct international investigations covering ransomware attacks and large-scale cryptocurrency theft.
I’ve read the complaint this week. The structural takeaway is how the network cracked: a single Ukrainian national arrested in Poland in September 2025. Forensic examination of that person’s devices identified the administrators behind AudiA6 and led to the Georgia arrests. The 6,000 KYC records seized in the action are a live asset now — each one represents a money mule account potentially traceable across other active investigations.
Both defendants face money laundering charges carrying up to 20 years. They’re in Georgian custody pending extradition. Their Dark2Web forum, where they advertised AudiA6 services to other cybercriminals, is displaying a seizure banner.
Worth auditing your institution’s AML transaction monitoring flags this quarter. The mule account records are in law enforcement hands.
— Rebecca Lauren