An international operation supported by Eurojust and Europol shut down the AudiA6 service, which cybercriminals used to launder more than €336 million worth of cryptocurrency between 2022 and 2025.
On June 10, coordinated actions by law enforcement authorities from the United States, France, Poland, Georgia, and Iceland led to the arrest of two suspected platform administrators in Georgia. Authorities also seized more than 30 servers and took down 25 domains.
How the Scheme Worked
AudiA6’s clients included extortionists seeking to launder stolen digital assets. A criminal would transfer cryptocurrency to wallets controlled by the group and, roughly an hour later, receive cleaned cryptocurrency in return. The funds had been routed through a complex chain of transactions designed to conceal their origin. The service charged fees ranging from 3% to 10%.
The same group is also believed to have operated the Dark2Web forum, where illegal services were advertised and cybercriminals from around the world could connect and network.
The service relied on thousands of fake accounts created using stolen or purchased identities. Investigators identified more than 6,000 KYC records linked to money mule accounts. A significant portion of those accounts involved Russian-speaking intermediaries who moved criminal proceeds through cryptocurrency exchanges.
Authorities published a list of domains used to register these accounts so that exchanges could identify and block any accounts connected to them.
Arrests and Asset Seizures
In addition to the arrests, Georgian law enforcement authorities seized more than 80 vehicles and several properties.
Authorities froze €692,000 in cryptocurrency and confiscated an additional €86,000.
One of the suspects was arrested in Poland in September 2025. The arrests in Georgia were carried out at the request of the Polish prosecutor’s office, whose cybercrime unit led the investigation.