International sting shuts down $390M crypto money-laundering ring
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- AudiA6 processed approximately 336 million euros (~$390M) in illicit funds from 2022 to 2025, with its wallets receiving ~10,333 BTC since 2021 according to Chainalysis
- Authorities arrested two administrators — Russian and Ukrainian nationals — in Georgia, seizing 25 domains, more than 30 servers, 80 vehicles, and freezing ~$900,000 in cryptocurrency, per Eurojust
- The mixer operated as a 'mixer-as-a-service,' offering to clean crypto within about an hour for a 3% to 10% commission, primarily to ransomware groups cashing out stolen funds
- The same syndicate ran a parallel Dark2Web marketplace used to advertise illicit services and connect cybercriminals worldwide, Eurojust said
- Investigators identified more than 6,000 fraudulent Know Your Customer (KYC) records tied to 'money mule accounts,' many operated by Russian-speaking intermediaries recruited to move criminal proceeds through crypto exchanges
- AudiA6 laundered part of a ransom paid by an Australian business in 2024 following a ransomware extortion attack, per the Australian Federal Police
- The wider ransomware landscape is consolidating: the top 10 groups accounted for 71% of Q1 2026 victims and the US represented 64.7% of all recorded victims, according to Check Point Research and Emsisoft
Why it matters: The sting combined a physical arrest of two administrators in Georgia with infrastructure seizures across 11 countries, coordinated through Eurojust and Europol. For ransomware groups — already consolidating around 10 dominant operators that account for 71% of Q1 2026 victims per Check Point — losing a mixer that cleaned BTC in roughly an hour removes a piece of cashout infrastructure they were demonstrably using.
Ask SkimNews
