Europol Disrupts AudiA6 Crypto Laundering Service Linked to Ransomware Gangs
Summary
Europol and partners disrupted AudiA6, a crypto-laundering service authorities estimate handled over €336 million since 2021. Two alleged administrators were arrested and charged in the U.S.; the operation seized servers, domains and crypto assets.
Key points
- Europol said a coordinated operation on June 10, 2026, dismantled AudiA6 and replaced its websites with law-enforcement seizure banners.
- Authorities estimate AudiA6 laundered more than €336 million in illicit proceeds since its launch in 2021.
- Two alleged administrators were arrested in Georgia and charged in the U.S. with conspiracy to launder monetary instruments and sting money laundering.
- The operation included takedowns of 25 domains, seizure of more than 30 servers, and freezing or seizure of cryptocurrency assets.
- The U.S. Department of Justice said about 393.39 BTC received by AudiA6 came directly from known darknet markets, ransomware organizations, cybercrime services and other illicit sources.
- Investigators linked AudiA6 to more than 15 investigations worldwide; TRM Labs reported that funds stolen in the 2022 LastPass hack were routed through Cryptex and AudiA6.
- Europol said the service used fraudulent exchange accounts opened with stolen or purchased identities, and investigators identified more than 6,000 KYC records linked to money mule accounts.
Article Details
- Event Type
- International law-enforcement disruption of the AudiA6 cryptocurrency-laundering service, including arrests, seizures, domain takedowns, and U.S. charges against two alleged administrators.
- Impact
- Authorities estimate AudiA6 laundered more than €336 million since 2021 and link it to ransomware and cryptocurrency-theft investigations. The operation included server and cryptocurrency seizures and the blocking of network accounts. The U.S. DOJ charged two alleged administrators; the charges are allegations, not convictions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | deliverlett[.]com | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | deliverly[.]top | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | designli[.]pictures | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | flowcomm[.]click | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | inboxally[.]agency | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | inboxly[.]top | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | lett[.]email | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | lettermail[.]eu | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | mailora[.]eu | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | pheontx[.]eu | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | postfast[.]eu | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | postify[.]email | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | postino[.]click | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | qube[.]black | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | quix[.]express | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | smplfy[.]in | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | sumato-soft[.]org | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | technobrains[.]dev | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
| DOMAIN | trayo[.]app | Domain under AudiA6 operators' control, linked to email addresses used to register money-mule accounts with cryptocurrency exchanges. |
People
Alexander Vladimirovich LedenevIdentified by the U.S. DOJ as an alleged AudiA6 administrator and charged with conspiracy to launder monetary instruments and sting money laundering; the allegations are not a conviction.Ruslan Igorevich TkachukIdentified by the U.S. DOJ as an alleged AudiA6 administrator and charged with conspiracy to launder monetary instruments and sting money laundering; the allegations are not a conviction.
Countries
Australiaand the IRS Criminal Investigation, along with the Polish Police and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.Canadathe IRS Criminal Investigation, along with the Polish Police and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.FranceCriminal Investigation, along with the Polish Police and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.GeorgiaThe arrest of two alleged administrators of Ukrainian and Russian nationality in GeorgiaGermanyalong with the Polish Police and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.Icelandwith the Polish Police and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.Japanthe Polish Police and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.SwitzerlandPolice and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.United Kingdompartners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.United StatesThe operation led to arrests, seizures, domain takedowns, and U.S.