June 12, 2026

International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6

TRM data shows just five services absorb more than 50% of ransomware off-ramp volume each year

TRM Team

International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6

Key takeaways

Europol announced today that an international law enforcement operation dismantled AudiA6, a cryptocurrency laundering service that processed EUR 336 million for ransomware gangs and was linked to more than 15 international cybercrime investigations, including stolen proceeds from the 2022 LastPass breach and the Swissborg hack
Despite more than 600 services being available each year, ransomware groups routed between 42% and 57% of their off-ramp volume through just five services annually — a concentration pattern that persisted through multiple enforcement cycles and rebounded to 51% in 2025
TRM data shows ransomware payments totaled USD 1.3 billion in 2025, while ransom payments held steady at approximately USD 850 million
TRM's on-chain analysis independently identified Audi6 as a ransomware off-ramp in December 2025, tracing USD 7 million in LastPass-stolen funds to the exchange using proprietary demixing techniques
TRM data shows cross-chain bridges have replaced mixers as the primary obfuscation layer in ransomware laundering: bridge flows reached USD 100 million in 2025, overtaking mixer volumes for the first time in 2024

Europol announced today that an international law enforcement operation dismantled AudiA6, a cryptocurrency laundering service that processed EUR 336 million for ransomware gangs and was linked to more than 15 international cybercrime investigations, including stolen proceeds from the 2022 LastPass breach and the Swissborg hack.

In addition to the Europol takedown, on June 2, 2026, prosecutors in the Eastern District of Pennsylvania filed a criminal complaint charging Igorevich Tkachuk, 37, of Ukraine, and Alexander Vladimirovich Ledenev, 25, of Russia, with operating AudiA6. Both defendants were arrested this week in Batumi, Georgia, and prosecutors will seek extradition. The defendants are charged with money laundering under 18 U.S.C. § 1956. AudiA6 also operated Dark2Web, a cybercrime forum where users paid to commission crimes against specific targets.

In six undercover transactions conducted between December 2022 and May 2026, federal agents documented operators actively soliciting dirty funds and knowingly confirming the criminal origin of proceeds. When one undercover agent asked whether proceeds from cocaine sales were acceptable, the operator responded: "Everything like that needs to go through a mixer." In other exchanges, agents explicitly represented that funds derived from criminal activity, and operators confirmed they would process them.

AudiA6 is a high-risk exchange, and its illicit exposure profile distinguishes it from general-purpose services. Approximately 80% of AudiA6's traced illicit counterparty exposure — USD 63 million of USD 79 million total — ties directly to ransomware. Sanctions exposure, cybercrime services, and darknet market activity account for most of the remainder.

Its volume trajectory reinforces that profile. AudiA6's total incoming volume peaked in 2023 and declined through 2024 and 2025. Its illicit share moved in the opposite direction — under 1% in 2022, rising to over 6% in 2024. Legitimate use declined while criminal use increased — this is a recurring signature of services captured by high-risk clientele.

The LastPass connection illustrates how that footprint becomes traceable. TRM's on-chain analysis of the 2022 LastPass breach traced a September 2025 wave of stolen funds — approximately USD 7 million — from Wasabi Wallet to AudiA6 using cluster-level demixing, timing and amount alignment, and post-mix wallet intelligence. That analysis identified AudiA6 as a ransomware off-ramp independent of and prior to the Europol operation.

Ransomware payments remain elevated, off-ramp ecosystem is concentrated

TRM data shows ransomware groups reached approximately USD 1.3 billion (down from USD 1.9 billion in 2024), while ransom payments held steady at approximately USD 850 million. At the same time, victim postings on leak sites rose by 44%, indicating growing activity alongside declining payment rates.

AudiA6 shows how the ransomware financial infrastructure processing these illicit gains works: by concentrating proceeds through a handful of nodes that have the liquidity, tolerance for criminal activity, and reach that criminal networks require.

TRM's analysis of ransomware off-ramp flows shows a consistent pattern. Between 600 and 760 distinct services receive ransomware-attributed funds in any given year. The top five services alone account for between 42% and 57% of total off-ramp volume annually. The top ten handle between 62% and 75%.

Despite hundreds of available services, the top five consistently absorb more than 40% of all ransomware off-ramp volume. Source: TRM Labs, 2020–2025.

Concentration dipped to 42% in 2023 as enforcement actions disrupted several key nodes, then rebounded to 51% in 2025.

Criminal networks gravitate toward services that offer the liquidity and reliability their operations require, and those services accumulate the volume that makes them further attractive. Enforcement has disrupted individual nodes repeatedly. The concentration pattern itself has held across five consecutive years.

From mixers to bridges

The composition of ransomware off-ramp activity has shifted alongside enforcement pressure. Mixers dominated through 2021, absorbing USD 152 million in ransomware-attributed flows. Enforcement actions — including the shutdown of ChipMixer in March 2023 — drove that figure down to USD 48 million in 2024. Cross-chain bridges likely filled the gap opened by these shutdowns.

Bridge-based ransomware laundering overtook mixers for the first time in 2024 and reached USD 100 million in 2025. Source: TRM Labs, 2020–2025.

Bridge flows reached USD 100 million in 2025, more than double 2021 levels. For the first time, bridge volumes were higher than mixer volumes for the year. Unlike purpose-built mixing services, cross-chain bridges serve a broad range of legitimate use cases, which makes enforcement through a single targeted action more complex. The shift doesn't eliminate the traceability of ransomware proceeds, but it distributes obfuscation across infrastructure that isn't exclusively illicit.

BlackCat, Qilin, and LockBit sent largest volumes to AudiA6

TRM's on-chain data identifies 20 distinct ransomware groups that sent funds to AudiA6. The three largest were ALPHV BlackCat (USD 9.1 million), Qilin (USD 7.1 million), and LockBit (USD 4.4 million). In addition to these three, prolific groups such as Akira (USD 386.2K), Chaos/Blacksuit (USD 3.65 million), The Gentlemen (USD 99.6K), and RansomHub (USD 975.9K) also sent funds to AudiA6 consistently over time. The established cybercrime platforms Exploit and Verified also sent funds to AudiA6, highlighting the key role that AudiA6 played in the larger cybercriminal ecosystem.

ALPHV BlackCat's attacks included a February 2024 strike on Change Healthcare that disrupted healthcare systems across the United States, drawing a reported USD 22 million ransom payment. Qilin (aka Agenda) emerged in mid-2022 as a ransomware-as-a-service (RaaS) operation – TRM's on-chain analysis identified shared affiliate infrastructure linking Qilin payments to at least two other active ransomware groups, consistent with the RaaS model's use of affiliates who deploy multiple strains simultaneously. LockBit accumulated over USD 200 million in ransom payments before a coordinated operation disrupted its infrastructure in February 2024.

Concentration points offer enforcement opportunities

AudiA6 shows that ransomware proceeds concentrate in a small number of identifiable services because only some services fully meet their operational requirements. This concentration creates recurring investigative footholds.

TRM's demixing analysis published in 2025 identified AudiA6 as one of those footholds. By tracing LastPass-stolen funds through Wasabi's mixing layer and matching post-mix patterns to AudiA6 deposit addresses, TRM identified the same infrastructure the operation subsequently dismantled. The technique — cluster-level demixing at scale, timing and amount alignment across hops — reveals infrastructure reuse across ransomware campaigns more broadly.

That bridge trend, however, makes enforcement more complicated. Bridges obfuscate movement across infrastructure in a way that makes it hard to identify a single point of failure. Despite movement towards bridges, identifying an underlying concentration pattern is still best practice for investigators. As long as ransomware proceeds flow disproportionately through a small, identifiable set of nodes, coordinated enforcement has a viable target.

Frequently asked questions (FAQs)

1. What was AudiA6?

AudiA6 is a cryptocurrency laundering service that processed EUR 336 million for ransomware gangs and was linked to more than 15 international cybercrime investigations. Approximately 80% of its traced illicit exposure tied directly to ransomware, with the remainder split across sanctions exposure, cybercrime services, and darknet market activity.

2. Who operated AudiA6?

US prosecutors charged Igorevich Tkachuk, 37, of Ukraine, and Alexander Vladimirovich Ledenev, 25, of Russia with operating the service. Both were arrested in Batumi, Georgia; prosecutors are seeking extradition on money laundering charges under 18 U.S.C. § 1956. AudiA6 also operated Dark2Web, a cybercrime forum where users paid to commission crimes against specific targets.

3. How did TRM identify AudiA6 before the operation?

In December 2025, TRM’s on-chain analysis traced approximately USD 7 million in LastPass-stolen funds from Wasabi Wallet to AudiA6 using cluster-level demixing, timing and amount alignment, and post-mix wallet intelligence — independent of and prior to the Europol enforcement action.

4. Why do ransomware groups concentrate through so few services?

Criminal networks gravitate toward services that offer the liquidity and operational reliability their business model requires. Between 600 and 760 distinct services receive ransomware-attributed funds in any given year, yet the top five consistently absorb 42–57% of total off-ramp volume. That concentration persisted through multiple enforcement cycles and rebounded to 51% in 2025.

5. What is the shift from mixers to cross-chain bridges?

Mixer volumes in ransomware laundering fell from USD 152 million in 2021 to USD 48 million in 2024, driven partly by enforcement actions including the ChipMixer shutdown. Bridge flows filled much of that gap, reaching USD 100 million in 2025 — overtaking mixer volumes for the first time. Unlike purpose-built mixers, bridges serve broad legitimate use cases, which makes single-node enforcement more complex.

6. Which ransomware groups used AudiA6?

TRM identified 20 distinct groups. The three largest by volume were ALPHV BlackCat (USD 9.1 million), Qilin (USD 7.1 million), and LockBit (USD 4.4 million). Other groups including Akira, Chaos/Blacksuit, and RansomHub also sent funds to AudiA6 consistently over time.