The U.S. Department of Justice has unsealed criminal charges against Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national, for their alleged operation of AudiA6, a cryptocurrency laundering service. According to the U.S. Attorney's Office for the Eastern District of Pennsylvania, both defendants were arrested on Wednesday in Batumi, Georgia, and are currently awaiting extradition to the United States. Each faces one count of conspiracy to launder monetary instruments and one count of money laundering. The charges represent one of the largest cryptocurrency laundering cases to be prosecuted by U.S. authorities, highlighting the growing sophistication of digital asset-based criminal operations.
The criminal complaint alleges that Tkachuk and Ledenev are senior members of the AudiA6 organization and also manage the Dark2Web cybercrime forum, where AudiA6 advertised its services. Through blockchain analysis, law enforcement determined that approximately 10,333 bitcoins had been deposited into AudiA6's cryptocurrency wallets since the service launched in 2021. Of this total, approximately 393.39 BTC arrived directly from known darknet markets, ransomware organizations, cybercrime services and other illicit sources, while the remaining funds were deposited indirectly from illicit sources. The network allegedly processed more than $389 million in transactions since its inception, demonstrating the substantial scale of the laundering operation. According to the DOJ statement, the defendants allegedly charged fees of up to 5% to conceal the origin of illicit funds. However, recent analysis reveals that only 393.39 BTC, worth roughly $19.2 million, arrived directly from darknet markets, representing under 4% of all deposits, suggesting customers layered coins before ever touching the service.
A newly unsealed DOJ complaint revealed that AudiA6 marketed sophisticated services designed to help cybercriminals evade exchange anti-money laundering checks. The complaint alleges that operators used terms such as "dirty" and "clean" crypto while advertising services designed to "cut off your tails," a phrase investigators said referred to removing blockchain traces connected to criminal activity. Authorities also said the service marketed low AML risk scores to help funds avoid exchange freezes, with the affidavit claiming AudiA6 promised that laundered funds would carry an AML risk score below 25%, a threshold investigators said many exchanges use when screening suspicious transactions. The DOJ argued the alleged operation effectively manipulated exchange compliance systems and turned exchanges into "unwitting partners" in laundering activity.
The complaint described several undercover operations conducted between 2022 and 2026 that demonstrated AudiA6's willingness to process illicit funds. In one interaction, undercover agents allegedly told AudiA6 operators they wanted to mix funds tied to ransomware activity, with the service agreeing to process the transaction and returning cleaned cryptocurrency after taking a commission. Another undercover exchange allegedly involved agents asking whether stolen ETH from scams could be mixed, according to the complaint, with AudiA6 responding "yes, no problem." These operations demonstrate how the service actively facilitated criminal activity while maintaining its operational capabilities.
The operation was conducted as a joint task involving multiple international agencies, including the U.S. Secret Service, Internal Revenue Service Criminal Investigation, Europol and Eurojust. The international coalition included law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Poland, Switzerland and the United Kingdom. The joint action included searches of three properties, targeting of servers and domains across the United States, Iceland, Germany and France, blocking of Telegram accounts used by the network, and freezing of cryptocurrency assets alongside the seizure of digital devices. At the same time, law enforcement agencies replaced both the clear web and dark web infrastructure connected to AudiA6 and the Dark2Web forum with seizure notices, effectively shutting down the network's operational capabilities. The same enforcement approach has been successful in other cases, with German and Swiss authorities seizing three servers and over 25 million euros in November, as reported by Eurojust.
The complaint portrays AudiA6 as more than a simple crypto mixer, alleging the operation maintained darknet forums, escrow systems, exchange services, Telegram channels, Tor websites, and cross-chain conversion infrastructure. Authorities believe the network operated as a long-running cybercrime infrastructure business designed to help criminals move funds across the crypto ecosystem while avoiding detection. If convicted, the defendants each face up to 20 years in prison. The case represents one of the most sophisticated cryptocurrency laundering operations dismantled by U.S. authorities, highlighting the growing complexity of digital asset-based criminal networks and the need for enhanced international cooperation in combating cybercrime infrastructure. The DOJ has simultaneously pursued other major cases, including charges against two Russian nationals over a $1 billion laundering operation and a billion-dollar Venezuelan scheme, demonstrating the agency's commitment to combating digital asset-based financial crimes.
