Disrupted, Not Dismantled: What the AUDIA6 Operation Reveals About Illicit Crypto Infrastructure
The takedown struck a key node in the crypto laundering ecosystem, but broader illicit finance infrastructure continues to enable both criminal and state actors.
Hello, Insight Monitor subscribers! In June, EUROPOL announced the disruption of a cryptocurrency laundering service, AUDIA6. This service enabled illicit actors to make their stolen, exfiltrated, or otherwise illicitly acquired funds appear legitimate. So what does this disruption mean for the illicit crypto ecosystem, and what was the Canadian connection? Have a read to learn more:
In 2025, ransomware gangs stole roughly US$ 820 million from cryptocurrency exchanges, and, unbelievably, this was actually a decrease from the year before. These funds were stolen by criminal gangs for profit, state-enabled gangs (like many that operate freely in Russia), and also by state actors like North Korea. These funds go to further other criminal activity, and in the case of North Korea, to help fund its intelligence services and ballistic missile and WMD program.
To make full use of these funds, ransomware actors have to launder the money they steal, essentially hiding the fact that it was the proceeds from a hack, exploit, or other cyberattack, and making it appear as though it came from legitimate sources.
These laundering services are significant illicit finance enablers. While some argue that there is a legitimate use case (and legitimate activity) happening on these services, the vast majority of laundered funds are from illicit sources like ransomware attacks.
One of these services is AUDIA6.
AUDIA6 is a cryptocurrency laundering service that processed more than €336 million for ransomware gangs, and has been linked to more than 15 international cybercrime investigations. In June 2026, EUROPOL announced that an international law enforcement operation dismantled this crypto laundering service. Two individuals were arrested, 25 domains were taken down, 30 servers were seized, and €692,000 in crypto was frozen and over €86,000 in crypto was seized.
AUDIA6 also operated Dark2Web, a cybercrime forum where users paid to commission crimes against specific targets.
AUDIA6 operated as a “mixer as a service”. As part of this operation, the service used over 6,000 KYC (“know your customer”)-verified accounts. These accounts were essentially money mules (individuals or accounts that knowingly or unknowingly move money on behalf of someone else), and were used to rapidly launder stolen digital assets through centralized cryptocurrency exchanges. These accounts were either stolen or purchased identities.
AUDIA6 charged a 3-10% commission on its services, and maintained connections to a variety of high-risk exchanges such as Bitzlato and Garantex.
The investigation and disruption of AUDIA6 was led by the US Secret Service, the IRS, and the Polish Police, with help from other EU member states and international partners, including the RCMP. The involvement of the RCMP raised some questions for me, so I asked them about it. Keep reading to find out what they had to say about their involvement in this operation:
Financial Intelligence Fundamentals
Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today
