Ransomware · 94 days ago
The takedown matters because it did more than cut off a cash-out service. Seizing the KYC records and linked account history turns a laundering hub into an attribution source for finding money mules and the ransomware crews that used them.
Europol says AudiA6 moved more than €336 million for ransomware gangs and cybercrime networks since 2021, and investigators recovered more than 6,000 KYC records tied to mule accounts. The June 10 operation also hit Dark2Web, seized more than 30 servers and 25 domains, blocked Telegram accounts, and led to arrests in Georgia.
That changes the follow-on risk. Blocking a mixer stops the payment path, but the preserved identity records can now support backtracking through exchanges and mule networks, and that evidence can outlast the laundering service itself.
4 sources covering this story
Ransomware Crypto Laundering Platform Taken Out by FBI and Europol
Domain of dark web money laundering platform AudiA6 seized and suspects arrested in joint operation by the FBI, Europol and others
Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs
Europol dismantled AudiA6, a crypto laundering service that washed €336M for ransomware gangs and cybercrime networks since 2021.
A cryptocurrency laundering service used by cybercriminals has been dismantled in an international law enforcement operation.
Authorities dismantle 'AudiA6' ransomware crypto-laundering service
Law enforcement has dismantled the “AudiA6” cryptocurrency service allegedly used by ransomware actors and other cybercriminals to launder more than $380 million.
Part of the PlainSec briefing for 2026-06-13