Europol says it has dismantled the AudiA6 crypto mixing service, which allegedly laundered $380M+ for ransomware actors and others between 2022 and 2025
Law enforcement has dismantled the “AudiA6” cryptocurrency service allegedly used by ransomware actors and other cybercriminals to launder more than $380 million.
Context & Ripple Effects
This follows a longer Europol record of coordinated action against ransomware operators, including the disruption of the DoppelPaymer group, alongside more recent cases targeting crypto-enabled fraud laundering. The AudiA6 case shifts the focus from individual criminal groups to a financial service allegedly supporting multiple types of cybercrime.
The reported activity spans 2022-25 and is linked by Europol to ransomware actors as well as other criminals. That makes the dismantling relevant as an intervention in the payment-and-cash-out layer of the cybercrime ecosystem, not solely a case against one ransomware operation.
First-order effects
- Ransomware actors and other alleged AudiA6 users lose access to a service Europol says processed more than $380M in illicit funds, disrupting an established route for moving crypto proceeds.
- Europol and partner agencies gain an operational result against infrastructure allegedly shared across criminal customers, potentially creating leads from the service's users and transactions.
Second-order effects
- Affected criminal groups will need to shift funds through other laundering routes, increasing operational friction and potentially exposing them to less trusted intermediaries or more traceable transaction patterns.
- Other crypto services associated with high-risk flows face greater scrutiny as investigators build on the AudiA6 operation and the broader enforcement attention to crypto-based fraud laundering.
Third-order effects
- If authorities continue pairing ransomware takedowns with action against their financial infrastructure, cybercrime enforcement will increasingly target the services that let separate criminal groups monetize attacks rather than only the groups conducting them.
- The case supports a broader contest over crypto's role in illicit finance: durable impact depends on whether enforcement can repeatedly constrain replacement laundering channels, not just dismantle individual services.
The trend: Law enforcement is broadening cybercrime disruption from arresting attack crews to targeting the shared crypto and online infrastructure that enables criminal operations to profit.