Overview
- A coordinated multinational operation on June 10–11 forcibly took the AudiA6 mixing site offline and seized its management servers.
- Two men, a Russian national and a Ukrainian national, were detained in Georgia by U.S. and partner authorities as suspected core operators of the service.
- Forensic recovery of seized server data produced about 6,000 account and email records and linked flows that investigators estimate total roughly €336 million laundered through AudiA6.
- Authorities say AudiA6 moved stolen crypto through many accounts to hide links, returning funds within about an hour for a 3–10% fee, which made it attractive to ransomware and hacking groups.
- Japan’s NPA Cyber Special Investigation Division traced AudiA6 flows in 2024 and joined the multinational probe in July 2025, and investigators say further prosecutions and international asset-tracing are expected as analysis continues.