Crypto Laundering Network Linked To Ransomware Gangs Dismantled By Law Enforcement

TL;DR

• Chainalysis says law enforcement has dismantled AudiA6, a crypto laundering network linked to ransomware and darknet activity.
• The firm says the network processed about 10,333 BTC since 2021, historically valued at roughly $389 million.
• Authorities arrested two suspected senior administrators in Georgia, while the U.S. is seeking extradition.
• The case highlights how illicit crypto cash-out networks can rely on legitimate exchanges, mule accounts, and darknet infrastructure.

An international law enforcement operation has dismantled a cryptocurrency laundering network known as AudiA6, according to blockchain analytics firm Chainalysis, in a case that shows how ransomware-linked funds can move through a mix of darknet services, mule accounts, and centralized exchange infrastructure.

In a June 11 report, Chainalysis said the operation targeted AudiA6, which it described as a cryptocurrency laundering platform and “mixer-as-a-service” provider used by ransomware actors, darknet markets, and other cybercrime services. The company said the network had processed approximately 10,333 bitcoin since launching in 2021, historically valued at around $389 million.

According to Chainalysis, the coordinated enforcement action involved multiple agencies, including the U.S. Department of Justice, the U.S. Secret Service, Europol, and other international partners. Authorities arrested two suspected senior administrators in the Republic of Georgia: a 37-year-old Ukrainian national and a 25-year-old Russian national. The United States is seeking their extradition.

Law enforcement also seized digital infrastructure across the United States and Europe. Chainalysis said the websites tied to AudiA6 and an associated darknet cybercrime forum called Dark2Web were replaced with seizure banners, effectively cutting off access to infrastructure that allegedly helped criminal actors advertise, coordinate, and cash out illicit proceeds.

The case is significant because AudiA6 was not presented as a simple standalone mixer. Chainalysis described the network as part of a broader ecosystem in which cybercriminals could connect through Dark2Web, arrange laundering services, and move funds through a cash-out pipeline that touched both illicit and legitimate parts of the crypto economy.

Chainalysis said AudiA6 used more than 6,000 KYC-verified money mule accounts to help move funds through centralized cryptocurrency exchanges. In practice, that means the network allegedly exploited legitimate exchange infrastructure by routing illicit funds through accounts that had passed identity checks, making the activity harder to distinguish from normal user transactions.

The firm said investigators traced at least 393 BTC, historically valued at more than $19 million, directly from known ransomware actors, darknet markets, and other cybercrime services. Chainalysis also said more than $16 million tied specifically to ransomware and stolen funds was washed through the network.

The laundering service allegedly charged a commission of between 3% and 10%. Chainalysis said the system could return obfuscated funds to clients within an estimated one-hour window, giving criminal users a relatively fast way to convert or move proceeds after attacks.

The report also linked AudiA6’s cash-out infrastructure to sanctioned Russian exchanges, including Bitzlato and Garantex, and said the network had meaningful exposure to Exploit.in, a Russian-language cybercrime forum that operates an escrow service. Chainalysis also noted that Europol identified domains allegedly used by administrators to register fraudulent mule accounts, including designli.pictures, deliverly.top, and inboxly.top.

For the wider crypto market, the AudiA6 case is a reminder that enforcement pressure is increasingly focused on the infrastructure around cybercrime, not just the initial thefts or ransomware payments. Investigators are looking at where funds move next, which services facilitate cash-outs, and how illicit actors try to blend into compliant platforms.

That distinction matters. Centralized exchanges and payment rails are not necessarily the origin of criminal activity, but they can become attractive targets for laundering networks if mule accounts and weak monitoring practices create enough room for bad actors to operate. Chainalysis’ report suggests AudiA6 relied heavily on that gap.

The case also underlines why blockchain analytics has become a central part of crypto-related law enforcement. Public blockchains can give investigators a transaction trail, but turning that trail into an enforcement action often requires linking wallets, service infrastructure, domains, cash-out accounts, and real-world operators.

For legitimate crypto users and companies, the takeaway is not that crypto is uniquely criminal. It is that the same transparency that allows funds to move globally can also give investigators a map when laundering networks become large enough to leave patterns behind.

With the AudiA6 takedown, law enforcement appears to be sending a clear message: the services that help ransomware groups and darknet vendors convert crypto into usable funds are now firmly in the crosshairs.