International sting shuts down $390M crypto money-laundering ring
Eleven countries shut down AudiA6, a crypto laundering ring that moved over 336 million euros in illicit funds and froze about $900,000 in crypto.
Intelligence analysis by GPT-5.4 Mini
Authorities from 11 countries dismantled AudiA6, a mixer-as-a-service tied to ransomware cash-outs and a separate dark-web marketplace. The operation arrested two administrators, seized infrastructure, and exposed thousands of fake KYC records.
It was like police finding a secret money-washing machine for online thieves. The people behind it helped turn stolen digital money into harder-to-trace cash, but investigators from many countries shut the machine down and seized its parts.
Analysis
What happened
An international law enforcement operation involving 11 countries shut down AudiA6, a crypto laundering ring that Eurojust says processed more than 336 million euros, or about $390 million, in illicit funds between 2022 and 2025. Authorities arrested two administrators in Georgia, seized 25 domains, more than 30 servers and 80 vehicles, and froze roughly $900,000 in cryptocurrency.
How the scheme worked
Eurojust described AudiA6 as a "mixer-as-a-service" used by cybercriminals, including ransomware actors, to cash out stolen crypto and hide where the money came from. The service allegedly promised to "clean" crypto in about an hour for a fee of 3% to 10%. Chainalysis said wallets tied to the service received about 10,333 BTC since 2021, worth roughly $389 million at the time of those transactions.
The investigation also found a second platform called Dark2Web, which was used to advertise illicit services and connect cybercriminals. According to Eurojust, the laundering network relied on thousands of fraudulent accounts built from stolen or purchased identities. Investigators identified more than 6,000 KYC records linked to money mule accounts, including intermediaries recruited to move criminal proceeds through exchanges.
Why it matters
The case shows how crypto crime often depends on a wider support system: mixers, fake identities, mule accounts, and dark-web marketplaces. It also shows why multinational coordination matters. The investigation involved agencies from the US, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the UK, coordinated through Eurojust and Europol.
The broader backdrop is that ransomware remains active even as the ecosystem concentrates around fewer operators. That means shutting down a large laundering service can disrupt a major piece of the criminal pipeline, even if it does not end the underlying threat.
Key points
- Eleven countries coordinated to shut down AudiA6, a crypto laundering ring tied to ransomware cash-outs.
- Authorities arrested two administrators in Georgia and seized domains, servers, vehicles, and crypto.
- Eurojust said the service laundered more than 336 million euros between 2022 and 2025.
- Investigators found over 6,000 KYC records tied to money mule accounts and fake identities.
- A separate marketplace, Dark2Web, was also linked to the same cybercrime network.
If the shutdown sticks, it could make it harder for ransomware gangs to turn stolen crypto into usable money. Seizing domains, servers, and fake identity records may also help investigators spot similar laundering setups sooner.
The article suggests the wider ransomware market is still active, so other mixers or marketplaces could take AudiA6’s place. If criminals rebuild with new fake identities and mule accounts, the disruption may be temporary rather than lasting.
