Cyber & Technology — 2026-06-11

Authorities Dismantle AudiA6 Ransomware Crypto-Laundering Service

BLUFSeized KYC records from 6,000 money mule accounts give investigators a roadmap into at least 15 ransomware networks, though extradition of both suspects from Georgia remains genuinely uncertain.

Georgian authorities on June 10 arrested Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25, in Batumi as alleged administrators of AudiA6, a cryptocurrency mixing service that processed approximately $389 million in illicit funds between 2022 and 2025 12. The U.S. Attorney's Office for the Eastern District of Pennsylvania charged both with money laundering conspiracy and will seek extradition; each faces up to 20 years in prison 1. Europol and Eurojust reported the 11-country operation seized 25 domains, over 30 servers, and more than 80 vehicles and properties, and recovered 6,000 KYC records from money mule accounts opened with stolen identities 34. Device forensics from a co-conspirator arrested in Poland in September 2025 led investigators to identify and locate the pair 34.

Analysis
Dismantling AudiA6 removes a laundering hub tied to at least 15 active ransomware investigations, though affiliated operators may have migrated funds through alternative services during the final investigation phase, capping the disruption to the onboarding interval for replacement infrastructure. Six undercover transactions, confirmed by Europol and Eurojust as direct participants, established that the service's advertised anonymization failed outright, leaving records directly traceable through exchange logs. Extradition of Tkachuk and Ledenev to Philadelphia within 18 months of their June arrest is genuinely uncertain. Moderate confidence rests on documented Georgian operational cooperation during the June 10 action; no precedent exists for Georgia extraditing Russian or Ukrainian nationals to the United States in a comparable timeframe. If extradition proceeds, EDPA prosecutors hold a cooperation lever exposing AudiA6's ransomware client list; if it stalls, the 6,000 recovered KYC records and money mule network become the primary enforcement axis.
4 sources
  1. Philly feds charge two with running a cryptocurrency money laundering scheme that tried to conceal nearly $400 million - The Philadelphia Inquirer
  2. Ransomware gangs cut off from EUR 336 million 'AudiA6' crypto laundering pipeline - Europol
  3. Cryptocurrency money laundering site shut down thanks to coordinated investigation - Eurojust
  4. Authorities dismantle AudiA6 ransomware crypto-laundering service - BleepingComputer

View in full brief →

UNCLASSIFIED // OPEN SOURCE