U.S. prosecutors have charged two men accused of operating AudiA6, a cryptocurrency laundering service allegedly responsible for more than $389 million in unlawful transactions.
The Eastern District of Pennsylvania charged Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national, with conspiracy to launder monetary instruments and sting money laundering. Both were arrested in Georgia and remain in Georgian custody while U.S. authorities seek extradition.
Prosecutors allege that AudiA6 functioned as a high-fee laundering pipeline for cybercriminals. The service allegedly took crypto tied to criminal activity, moved it through controlled wallets and transaction layers, then returned funds that appeared harder to trace. The related Dark2Web cybercrime forum allegedly helped advertise illicit services and connect criminal actors.
The complaint says roughly 10,333 BTC, worth about $389.7 million at the time of the transactions, entered AudiA6 wallets after the service launched in 2021. Out of that amount, about 393.39 BTC, worth roughly $19.2 million at transaction-time values, allegedly came directly from darknet markets, ransomware organizations, cybercrime services and other known illicit sources. Prosecutors said more funds came indirectly from illicit sources.
The defendants are presumed innocent unless proven guilty in court. If convicted, each faces a maximum possible sentence of 20 years in prison.
Global Takedown Hits Servers, Domains And Crypto
The charges came with a coordinated international takedown of AudiA6 and related infrastructure. Authorities searched three properties, targeted servers and domains in the United States, Iceland, Germany and France, blocked Telegram accounts tied to the network, froze cryptocurrency assets and seized digital devices.
The clear-web and dark-web versions of AudiA6, along with the Dark2Web forum, were replaced with law-enforcement seizure banners.
Eurojust said the service laundered more than €336 million in criminal cryptocurrency between 2022 and 2025. The June 10 action in Georgia led to two arrests, three property searches, 25 domains taken down, more than 30 servers seized, over 80 vehicles and multiple properties seized, about €692,000 in cryptocurrency frozen and more than €86,000 in cryptocurrency seized.
The operation involved U.S., Polish, Georgian, French and Icelandic authorities, with support from Eurojust and Europol. The U.S. side included the Secret Service, IRS Criminal Investigation, Homeland Security Investigations and other agencies.
AudiA6 Had Already Appeared In Crypto Theft Trails
The case also explains why AudiA6 had already become familiar to crypto investigators. ZachXBT highlighted the DOJ charges shortly after publication and had previously traced several stolen-fund routes toward AudiA6-linked infrastructure.
One major example came from the fake Ledger Live app that appeared on Apple’s App Store in April. That campaign allegedly drained about $9.5 million from more than 50 victims across Bitcoin, Ethereum-compatible chains, Tron, Solana and XRP. ZachXBT’s tracing tied the funds to more than 150 KuCoin deposit addresses allegedly linked to AudiA6, while a separate Bitcoin Depot-related theft allegedly used more than 25 KuCoin addresses before reaching similar laundering infrastructure.
Those earlier traces made AudiA6 part of the wider debate over exchange deposit controls, high-fee laundering services and how stolen crypto moves from victim wallets into cashout routes. The takedown now turns that same name into a federal criminal case.
AML Enforcement Keeps Moving To Infrastructure
The AudiA6 charges fit the broader enforcement shift from single scams toward the infrastructure that helps stolen funds move. Crypto crime cases increasingly target laundering services, mule account networks, cybercrime forums, exchange deposit clusters and off-ramp operators rather than only the people who drain wallets.
That shift has already been visible across recent cases, including the Samourai Wallet founders’ guilty pleas in a $100 million Bitcoin laundering case and the wider AML crackdown overtaking SEC securities cases as crypto’s top regulatory risk. The same pattern appeared in large scam-center actions, where authorities moved against recruiters, operators and laundering channels behind industrial crypto fraud, including a global crackdown that dismantled nine fraud centers.
For exchanges and service providers, the message is direct. Laundering infrastructure is now a primary enforcement target, and investigators are following the full chain from theft, ransomware and darknet markets into mixers, OTC services, mule accounts and exchange deposit networks. AudiA6 may be one case, but the takedown shows how quickly an underground cashout service can become a multinational cybercrime operation.
Be the first to comment