Blab Crypto
International Sting Operation Seizes $390 Million Crypto Laundering Ring Linked to Ransomware
On June 11 2026, an international law‑enforcement raid dismantled the AudiA6 crypto‑laundering network, seizing more than €336 million (about $390 million) of illicit funds that had flowed through the service between 2022 and 2025.
The operation cut across 11 countries and culminated in the arrest of two administrators—one Russian and one Ukrainian—during coordinated raids in Georgia. Authorities seized the servers, domains and cryptocurrency assets tied to the service.
AudiA6 operated by creating and managing roughly 6,000 fake Know‑Your‑Customer (KYC) accounts. Ransomware groups and other cybercriminals used these accounts to move stolen digital assets while obscuring the money trail. The service also had links to the Dark2Web marketplace, a platform that facilitates the sale of stolen data and illicit services.
Europol led the effort, coordinating with agencies from the United States, the United Kingdom, Germany, France, Italy, Spain, the Netherlands, Poland, Ukraine and Georgia. The joint effort enabled investigators to map the network’s infrastructure, trace the flow of funds and disrupt the laundering pipeline.
The arrests and seizures are part of a wider crackdown on ransomware. In the first quarter of 2026, ransomware attacks were reported in 97 countries, with 64.7 % of all victims located in the United States. AudiA6 had become a central hub for criminals seeking to convert stolen cryptocurrency into assets that appeared legitimate.
The case underscores the growing sophistication of cybercrime operations. Chainalysis’ 2026 Crypto Crime Report noted that illicit cryptocurrency flows reached $51 billion in 2025, prompting regulators to tighten anti‑money‑laundering (AML) controls. In Europe, the Markets in Crypto‑Assets (MiCA) framework, which entered into force in 2023, now requires crypto‑service providers to implement robust AML procedures.
The seizure also highlights the importance of international cooperation. Success hinged on shared intelligence, joint investigations and coordinated asset‑freezing orders across multiple jurisdictions.
Industry analysts say the dismantling of AudiA6 will temporarily disrupt ransomware groups’ ability to launder proceeds, but new laundering services may emerge. The 2026 Crypto Crime Report indicates that professionalised cybercrime services are increasingly using sophisticated mixing and obfuscation techniques to evade detection.
At present, the seized assets remain frozen and the two administrators face charges under the laws of the countries that conducted the arrests. Europol and partner agencies continue to investigate related networks and identify additional actors involved in the laundering chain.
The operation serves as a reminder that cryptocurrency remains a tool for illicit activity and that regulatory and enforcement efforts must evolve to keep pace with the technology. It also illustrates how coordinated international action can effectively target sophisticated money‑laundering schemes.
The current status is that AudiA6’s infrastructure has been dismantled, its administrators are in custody, and the seized cryptocurrency is under legal hold. Regulators are reviewing the case to assess whether existing AML frameworks adequately address the methods used by the ring, while the broader crypto community monitors the outcome for signals on how future enforcement actions may be structured.
The operation cut across 11 countries and culminated in the arrest of two administrators—one Russian and one Ukrainian—during coordinated raids in Georgia. Authorities seized the servers, domains and cryptocurrency assets tied to the service.
AudiA6 operated by creating and managing roughly 6,000 fake Know‑Your‑Customer (KYC) accounts. Ransomware groups and other cybercriminals used these accounts to move stolen digital assets while obscuring the money trail. The service also had links to the Dark2Web marketplace, a platform that facilitates the sale of stolen data and illicit services.
Europol led the effort, coordinating with agencies from the United States, the United Kingdom, Germany, France, Italy, Spain, the Netherlands, Poland, Ukraine and Georgia. The joint effort enabled investigators to map the network’s infrastructure, trace the flow of funds and disrupt the laundering pipeline.
The arrests and seizures are part of a wider crackdown on ransomware. In the first quarter of 2026, ransomware attacks were reported in 97 countries, with 64.7 % of all victims located in the United States. AudiA6 had become a central hub for criminals seeking to convert stolen cryptocurrency into assets that appeared legitimate.
The case underscores the growing sophistication of cybercrime operations. Chainalysis’ 2026 Crypto Crime Report noted that illicit cryptocurrency flows reached $51 billion in 2025, prompting regulators to tighten anti‑money‑laundering (AML) controls. In Europe, the Markets in Crypto‑Assets (MiCA) framework, which entered into force in 2023, now requires crypto‑service providers to implement robust AML procedures.
The seizure also highlights the importance of international cooperation. Success hinged on shared intelligence, joint investigations and coordinated asset‑freezing orders across multiple jurisdictions.
Industry analysts say the dismantling of AudiA6 will temporarily disrupt ransomware groups’ ability to launder proceeds, but new laundering services may emerge. The 2026 Crypto Crime Report indicates that professionalised cybercrime services are increasingly using sophisticated mixing and obfuscation techniques to evade detection.
At present, the seized assets remain frozen and the two administrators face charges under the laws of the countries that conducted the arrests. Europol and partner agencies continue to investigate related networks and identify additional actors involved in the laundering chain.
The operation serves as a reminder that cryptocurrency remains a tool for illicit activity and that regulatory and enforcement efforts must evolve to keep pace with the technology. It also illustrates how coordinated international action can effectively target sophisticated money‑laundering schemes.
The current status is that AudiA6’s infrastructure has been dismantled, its administrators are in custody, and the seized cryptocurrency is under legal hold. Regulators are reviewing the case to assess whether existing AML frameworks adequately address the methods used by the ring, while the broader crypto community monitors the outcome for signals on how future enforcement actions may be structured.
