Europol Announces Takedown of AudiA6 Crypto Laundering Service

A structural disruption aimed not at one ransomware brand but at the shared plumbing every brand depends on to turn stolen crypto into spendable money.

THE HAGUE — Europol announced on June 12, 2026 that an international law enforcement operation had taken down AudiA6, a cryptocurrency laundering service the agency says processed more than €336 million in illicit funds for ransomware operators and other cybercriminals. The coordinated action, executed on June 10, resulted in two arrests in Georgia, the seizure of more than 30 servers, and the takedown of 25 domains tied to the operation, according to Europol.

The move continues a sustained law-enforcement campaign against the financial infrastructure of cybercrime rather than its individual perpetrators, the same strategic logic behind disruptions such as Operation Endgame 2.0. Where prosecutions of individual operators — such as the recent sentencing of a Karakurt extortion negotiator — punish people, takedowns like this one target the shared services the wider ecosystem depends on to function.

What Europol Announced

In a statement published June 12, 2026, Europol said an international operation had dismantled AudiA6, a service it described as a cryptocurrency laundering operation used by ransomware groups and other cybercriminals. According to Europol, the service is suspected of laundering proceeds from ransomware attacks and other forms of cybercrime between 2022 and 2025, processing more than €336 million in illicit funds over that period.

The coordinated takedown was carried out on June 10, Europol said. During the action, two alleged administrators were arrested in Georgia, three properties were searched, more than 30 servers were seized, 25 domains were taken down, and Telegram accounts linked to the service were blocked. Europol added that the operation also resulted in the seizure of more than 80 vehicles and multiple properties in Georgia, with approximately €692,000 in cryptocurrency frozen and more than €86,000 in cryptocurrency seized outright.

Europol said the suspects behind AudiA6 are also believed to have administered a dark web cybercrime forum known as Dark2Web, which the agency described as “a criminal marketplace used to advertise illicit services and connect cybercriminal actors worldwide.” The investigation, Europol said, involved the U.S. Secret Service, IRS Criminal Investigation, the Polish Police, Europol, and the EU judicial cooperation agency Eurojust, among other international partners. Europol noted the operation built on an earlier Polish investigation that led to the arrest of a Ukrainian suspect in September 2025, with material recovered from seized devices used to identify others allegedly involved.

The €336M Scope and the Ransomware Connection

The figure at the center of Europol's announcement — more than €336 million laundered between 2022 and 2025 — reflects the agency's assessment of the total value that flowed through AudiA6 over roughly three years of operation. Europol said the service marketed itself on cybercrime forums as a cryptocurrency mixing service, the category of tool designed to break the on-chain link between where funds originate and where they end up.

According to Europol, customers could expect to receive their laundered funds within about an hour, with operators charging fees of between 3% and 10% for the service. The agency said its investigation uncovered more than 6,000 Know Your Customer (KYC) records linked to money mule accounts used to push illicit funds through cryptocurrency exchanges — a detail that illustrates how the operation bridged anonymous crypto flows and the regulated financial system. Europol said the service was linked to at least 15 international investigations.

Europol attributed AudiA6's customer base to ransomware operators and other cybercriminals but, in the statement underpinning this report, did not publicly name the specific ransomware groups that used the service. The connection to ransomware is significant because cashing out is the chokepoint of the entire extortion business model: a ransom paid in cryptocurrency is of limited use to an operator until it can be moved, mixed, and converted into spendable funds without tipping off investigators or exchanges. A laundering service that promised clean funds inside an hour, for a single-digit-to-low-double-digit percentage fee, is precisely the kind of utility that lets the ransomware economy keep running.

The Pattern of Laundering-Service Takedowns

The AudiA6 action fits a clear and deliberate pattern in how international law enforcement has approached cybercrime over the past several years. Rather than chasing each ransomware brand individually — a game of whack-a-mole in which gangs rebrand and reconstitute faster than they can be prosecuted — agencies have increasingly trained their resources on the shared infrastructure that many criminal groups rely on in common.

That includes bulletproof hosting, malware loaders, initial-access marketplaces, and — as in this case — the financial laundering layer. The logic is structural: a single mixing service or money-laundering pipeline can serve dozens of unrelated criminal operations, so dismantling it imposes costs across the entire ecosystem at once. Europol's Operation Endgame 2.0, which targeted the malware-loader and initial-access tier of the ransomware supply chain, reflected the same philosophy applied to a different link in the chain.

The involvement of the U.S. Secret Service, IRS Criminal Investigation, and the Polish Police alongside Europol and Eurojust also underscores how these operations have become genuinely multinational, pooling financial-forensic capabilities, judicial cooperation, and on-the-ground enforcement across borders. The arrests in Georgia and the September 2025 arrest in Poland that seeded the investigation show how a single thread, pulled in one jurisdiction, can be used to unravel infrastructure operating across many.

Why Financial-Pipe Disruption Is the Durable Response

There is a reason agencies have gravitated toward this approach, and it has to do with where the leverage sits. Ransomware operators can re-tool quickly: new encryptors, new leak sites, and new affiliate programs can be stood up in weeks. What is harder to replace is trust-laden, high-throughput infrastructure — a laundering service that has proven, over years, that it can reliably clean large sums quickly and discreetly. That reputation cannot be rebuilt overnight, and its loss is felt across every customer that depended on it.

Disrupting the cash-out layer also attacks the economic incentive directly. Extortion only works if the proceeds can be realized, and every additional point of friction — higher fees, longer delays, greater risk of seizure — erodes the margin that makes the crime worthwhile. When a major laundering pipeline is taken offline and its KYC-linked mule accounts are exposed, the remaining services become more expensive and more dangerous to use, which raises the cost of doing business for the entire downstream criminal market.

That is why structural disruptions tend to have a longer half-life than individual arrests. A prosecuted operator can be replaced; a dismantled financial pipeline forces the ecosystem to find, vet, and trust a new one, and seizing the KYC records behind 6,000 mule accounts gives investigators a map for the next operation. It is the same defensive logic that runs through broader incident-response thinking: the most durable wins come from removing capabilities, not just punishing actors.

Open Questions

Several details remain unconfirmed or were not disclosed in Europol's announcement, and should not be assumed. The specific ransomware groups that used AudiA6 were not publicly named in the statement underpinning this report, so any attribution to particular brands is, for now, unestablished. The full list of countries whose agencies participated beyond those Europol identified, and the eventual charges and identities of the two arrested administrators, may become clearer as judicial proceedings advance.

It is also not yet clear how much of the €336 million figure is recoverable, how the seized cryptocurrency will be handled, or whether additional arrests will follow from the more than 6,000 KYC records investigators recovered. What is firmly established is narrower but consequential: Europol says it has dismantled a years-old laundering pipeline that moved more than €336 million for cybercriminals, arrested two alleged administrators, and seized the servers, domains, and assets behind one of the financial utilities the ransomware economy relied on to turn stolen crypto into money.

Sources