In this news:
An international law enforcement operation has successfully dismantled a cryptocurrency laundering service widely trusted by ransomware gangs and cybercriminal networks. The action disrupted a major financial pipeline that investigators say was used to launder hundreds of millions of euros in illicit proceeds.
The service, known under the moniker "Audi A6," is suspected of laundering more than €336 million between 2022 and 2025. Investigators believe the platform became a key hub for ransomware operators and other cybercriminals seeking to cash out stolen digital assets while obscuring the money trail from authorities.
The suspects behind Audi A6 are also believed to have administered the dark web cybercrime forum "Dark2Web," a marketplace used to advertise illegal services and connect cybercriminals from around the world.
The investigation involved parallel efforts by U.S. authorities and the IRS Criminal Investigation division on one side, and the Polish Police on the other, alongside EU member states and international law enforcement partners, with support from Europol and Eurojust.
The coordinated action resulted in:
The arrest of two alleged administrators of Ukrainian and Russian nationality in Georgia.
Multiple property searches.
The takedown of 25 domains and the seizure of more than 30 servers.
The seizure of over 80 vehicles and several high-value properties in Georgia.
The freezing of approximately €692,000 in cryptocurrency and the seizure of an additional €86,000 in digital assets.
The blocking of Telegram accounts used by the network.
The replacement of the Audi A6 and Dark2Web websites with law enforcement seizure notices.
A Crypto-Cleaning Service for Cybercriminals
Investigators uncovered an industrial-scale cryptocurrency laundering operation built around thousands of fraudulent exchange accounts opened using stolen or purchased identities.
Analysis by Europol linked the service to more than 15 investigations worldwide involving ransomware attacks and large-scale cryptocurrency thefts.
Marketed as a professional cryptocurrency mixing service, Audi A6 promised anonymity and speed. Customers typically contacted the operators through private messaging platforms and transferred stolen cryptocurrency to wallets controlled by the group. Within about an hour, they would receive "cleaned" funds that had been routed through a complex web of transactions designed to conceal their origin.
More than 6,000 Know Your Customer (KYC) records linked to money mule accounts were identified during the investigation. Many of these accounts were connected to Russian-speaking intermediaries who helped move funds through the system. The group also used commercial email providers and domains under its control to register accounts across multiple cryptocurrency exchanges.
Europol's Role
Europol's European Cybercrime Centre helped trace the illicit financial flows behind the operation. Its cybercrime and cryptocurrency specialists mapped the laundering infrastructure, tracked cross-border transactions, and supported national authorities with intelligence development throughout the investigation.
Europol and Eurojust also coordinated the multinational crackdown by facilitating intelligence sharing, supporting arrests and asset seizures, and helping authorities execute judicial measures across multiple countries.
According to Europol, cybercriminals are increasingly relying on sophisticated cryptocurrency laundering services, including mixers and cross-chain transfers, to rapidly conceal illicit funds and sustain the growing cybercrime economy.
.png)
