Global sting shuts $390M crypto laundering ring

TLDR

Global law enforcement has shut down AudiA6, a crypto mixer-as-a-service accused of laundering about $390 million in illicit funds.

1. AudiA6 and its Dark2Web marketplace were dismantled after a coordinated operation across 11 countries, with two alleged operators arrested and infrastructure seized.
2. The service reportedly processed around 10,333 BTC for ransomware groups and darknet markets, using fake KYC accounts and money mules to move funds through exchanges.
3. The takedown signals rising global pressure on mixing services and laundering infrastructure, which could mean tighter controls and more scrutiny across the crypto ecosystem.

Deep Dive

1. How The Sting Worked

Authorities in 11 countries dismantled the AudiA6 crypto laundering network and the related Dark2Web marketplace, which together allegedly processed over 336 million euros (about $390 million) in illicit funds between 2022 and 2025. Agencies coordinated through Europol and Eurojust and arrested two administrators, a Russian and a Ukrainian national, in Georgia, while seizing 25 domains, more than 30 servers, around 80 vehicles, and about $900,000 in cryptocurrency, according to Eurojust and a detailed Cointelegraph report.

U.S. prosecutors separately charged the two men with money laundering offenses, stating that roughly 10,333 BTC flowed through AudiA6 wallets since 2021, worth about $389 million at the time of transactions, and described the action as part of a broader multinational cybercrime operation targeting the service and its infrastructure, as outlined by Bitcoin.com.

2. What AudiA6 Was Doing

AudiA6 offered a mixer-as-a-service model, promising to clean crypto within about an hour for a 3 to 10 percent commission. Mixers pool and reshuffle coins to obscure where funds came from, which is attractive for criminals but also a regulatory red flag.

Blockchain analysis tied AudiA6 to ransomware groups and darknet markets, with hundreds of BTC directly linked to clearly illicit sources and more coming indirectly through layered transactions. Authorities say the group also ran Dark2Web, a forum that helped cybercriminals find laundering services and other illegal offerings.

The ring allegedly used more than 6,000 fraudulent KYC records tied to money mule accounts using stolen or purchased identities, allowing them to move funds through mainstream exchanges under seemingly legitimate profiles.

3. Why This Matters For Crypto Users

The takedown reinforces a clear trend: regulators and prosecutors are increasingly targeting the infrastructure that makes crypto crime cashable, from mixers and privacy tools to mule networks and weakly supervised exchanges.

We are already seeing faster intervention on large suspicious flows, such as Tether freezing tens of millions of USDT in other recent laundering cases, and exchanges tightening monitoring of high risk flows. Legitimate users who touch mixers, high risk P2P venues, or anonymous OTC routes should expect more compliance questions and possible blocks.

Going forward, more coordinated international actions like this are likely, especially against services that market themselves directly to ransomware actors and darknet vendors.

Conclusion

The AudiA6 takedown removes a significant laundering hub that helped ransomware and darknet operators turn stolen crypto into spendable funds. It also illustrates how coordinated international enforcement, analytics, and rapid freezes are tightening the net around illicit crypto infrastructure, raising both the risk and the friction for anyone operating in legally gray channels.