AudiA6 Cryptocurrency Laundering Service and Dark2Web Forum Dismantled in International Operation (EUR 336M Ransomware Cash-Out Pipeline) — Threadlinqs Intelligence
As of 2026-06-14, AudiA6 Cryptocurrency Laundering Service and Dark2Web Forum Dismantled in International Operation (EUR 336M Ransomware Cash-Out Pipeline) is a high-severity threat intel threat attributed to AudiA6, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 35 indicators of compromise.
Threat ID: TL-2026-0791 · Severity: HIGH · Status: RESOLVED · Category: THREAT_INTEL
Attribution: AudiA6 · FINANCIAL
Law enforcement from 11 countries dismantled 'AudiA6', a professional cryptocurrency mixing/laundering service that processed roughly EUR 336 million (~USD 389 million, ~10,333 BTC) of criminal
AudiA6 was a 'mixer-as-a-service' marketed on underground cybercrime forums as a professional cryptocurrency laundering platform. Cybercriminals deposited stolen or extortion-derived cryptocurrency into unhosted wallets controlled by AudiA6; the service then layered the funds through rapid, complex transaction chains and returned them 'cleaned' to the holder within approximately one hour, charging a commission of 3 to 10 percent. The platform operated between 2022 and 2025 (with deposit activity traced back to 2021) and is assessed to have processed approximately EUR 336 million (~USD 389 million), corresponding to roughly 10,333 bitcoin deposited.
To obscure fund origins, AudiA6 relied on industrial-scale obfuscation: chain-hopping, decentralized exchanges (DEXes), cross-chain bridges, mixer-based services, and layering through thousands of fraudulent exchange accounts. Investigators recovered more than 6,000 KYC-verified 'money mule' accounts created with stolen or purchased identities. Operators registered these accounts using commercial email services and a portfolio of custom domains (e.g., designli.pictures, deliverly.top, inboxly.top, qube.black) to evade exchange KYC controls.
Blockchain analysis (Chainalysis, TRM Labs) found that approximately 393.39 BTC (~USD 19.2 million at time of transaction) were received directly from known darknet markets, ransomware organizations, and other illicit sources. TRM identified roughly USD 63 million of USD 79 million (about 80%) of AudiA6's traced illicit counterparty exposure as tied directly to ransomware. At least 20 distinct ransomware groups sent funds to the service, led by ALPHV/BlackCat (~USD 9.1M), Qilin (~USD 7.1M), LockBit (~USD 4.4M), Chaos/BlackSuit (~USD 3.65M), RansomHub (~USD 975.9K), Akira (~USD 386.2K), and The Gentlemen (~USD 99.6K). Approximately USD 7 million in funds stolen via the 2022 LastPass breach were also traced to AudiA6. The service had on-chain links to sanctioned Russian exchanges Garantex and Bitzlato and the Russian-language criminal escrow forum Exploit.in.
The AudiA6 operators are also assessed to have administered Dark2Web, a dark-web cybercrime forum used to advertise illicit services (including AudiA6 itself) and connect threat actors. The coordinated June 10-12, 2026 takedown — led by the U.S. Secret Service, IRS Criminal Investigation, and Polish law enforcement with operational support from Europol and Eurojust — resulted in two arrests, more than 30 servers dismantled, 25 domains seized, over 80 vehicles and multiple properties confiscated in Georgia, EUR 692,000 in cryptocurrency frozen, and EUR 86,000 in cryptocurrency seized. Both the AudiA6 and Dark2Web sites now display law-enforcement seizure notices, and the suspects face up to 20 years' imprisonment. This is an infrastructure-disruption event against the ransomware-as-a-service economy's cash-out layer; no CVE or software vulnerability is applicable.
Target sectors: financial, cryptocurrency-exchanges
Target regions: Europe, North America, Asia
Detections & IOCs
As of 2026-08-23, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 35 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
THREAT_INTEL, HIGH, threat intelligence, cybersecurity, T1583, T1585, T1586, T1608, T1685, T1102, T1567, T1537, T1657, T1486
