U.S. prosecutors have charged two men based in the Republic of Georgia with running AudiA6, a cryptocurrency money laundering service alleged to have processed more than $389 million, following a coordinated international takedown of the operation’s infrastructure.

Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national, were arrested Wednesday and charged by criminal complaint with conspiracy to launder monetary instruments and sting money laundering, prosecutors with the U.S. Attorney’s Office for the Eastern District of Pennsylvania announced Thursday. Each faces a maximum of 20 years in prison if convicted.

The arrests coincided with a takedown of AudiA6’s infrastructure stemming from parallel investigations by the U.S. Secret Service, IRS Criminal Investigation, Europol, Eurojust, and law enforcement partners in Australia, Canada, France, Georgia, Germany, Iceland, Japan, Poland, Switzerland, and the United Kingdom.

Federal official allege Tkachuk and Ledenev are senior members of the AudiA6 organization who manage both the laundering service and the Dark2Web forum. Tkachuk allegedly used the monikers “AudiA6” and “xai,” while Ledenev allegedly operated as “Azazello.” According to the complaint, a Dark2Web advertisement posted in April 2021 by the AudiA6 account offered to conceal and disguise the source of customers’ cryptocurrency that would otherwise be traceable to criminal origins, for a fee of up to five percent of the funds laundered. 

Blockchain analysis determined that approximately 10,333 bitcoins, valued at about $389.7 million at the time of the transactions, were deposited in AudiA6 wallets since the service’s launch in 2021, prosecutors said. Of that, roughly 393 bitcoins allegedly came directly from known Darknet markets, ransomware organizations, cybercrime services, and other illicit sources, with additional funds arriving indirectly from illicit sources.

The complaint describes a laundering process in which customers’ cryptocurrency was moved through AudiA6 wallets to accounts opened at exchanges under assumed identities, converted to the stablecoin USDT, routed through a second exchange, and returned to the customer’s designated address minus a commission, typically within about an hour. 

Despite the service’s advertised claims that its transactions were often untraceable, investigators found the flows could be traced directly through exchange records. Undercover agents conducted transactions with the service through private Telegram chats, and IRS-CI agents separately traced millions of dollars from illicit sources through AudiA6, according to the complaint.

Europol said the dismantled service processed 336 million euros for ransomware gangs and was linked to more than 15 international cybercrime investigations, including stolen proceeds from the 2022 LastPass breach and the SwissBorg hack.

Blockchain analysis firm TRM Labs separately said its on-chain analysis had independently flagged AudiA6 as a ransomware off-ramp in December 2025, when the firm traced approximately $7 million in funds stolen in the LastPass breach from the Wasabi Wallet mixing service to AudiA6 using demixing techniques. Roughly 80 percent of AudiA6’s traced illicit counterparty exposure tied directly to ransomware, with sanctions exposure, cybercrime services, and Darknet market activity accounting for most of the remainder, according to the firm. 

The takedown strikes at a highly concentrated laundering ecosystem, according to TRM. Although as many as 760 distinct services receive ransomware-attributed funds in a given year, the top five consistently absorb between 42 percent and 57 percent of off-ramp volume, a share that rebounded to 51 percent in 2025, the firm said. TRM also reported that cross-chain bridges have displaced mixers as the primary obfuscation layer in ransomware laundering, with bridge flows reaching $100 million in 2025 after overtaking mixer volumes for the first time in 2024.