BREAKING NEWS: Ruslan Igorevich Tkachuk, a 37-year-old Ukrainian national, was arrested in Georgia on Saturday, June 13, 2026, in connection with a vast international money laundering and cybercrime operation that allegedly processed over €336 million in illicit cryptocurrency. Tkachuk, a key figure in the “AudiA6” cryptocurrency laundering service, now faces charges from the U.S. Department of Justice, with authorities seeking his extradition to the United States.
The Charges Against Ruslan Igorevich Tkachuk
Ruslan Igorevich Tkachuk stands accused of one count of conspiracy to launder monetary instruments and one count of sting money laundering. These charges stem from his alleged senior role in the AudiA6 organization, a sophisticated “mixer-as-a-service” that specialized in obscuring the origins of criminal cryptocurrency. He is also accused of managing the “Dark2Web” cybercrime forum, a platform where AudiA6’s illicit services were openly advertised.
According to the U.S. Attorney’s Office for the Eastern District of Pennsylvania, Tkachuk, alongside Russian national Alexander Vladimirovich Ledenev, resided in Batumi, Republic of Georgia, at the time of their coordinated arrests. The U.S. Department of Justice will pursue Tkachuk’s extradition, and if convicted, he faces a maximum possible sentence of 20 years in prison for each count.
Scale of the Multi-Million Euro Cybercrime
The AudiA6 service is believed to have laundered more than €336 million (approximately $389 million to $542 million) in cryptocurrency between 2022 and 2025. This industrial-scale operation facilitated the cleaning of funds for ransomware actors, darknet markets, and various cybercriminal enterprises. Blockchain analysis revealed approximately 10,333 Bitcoin, valued at around $389.7 million at the time of transactions, were deposited into AudiA6 wallets since 2021.
A significant portion of these funds, at least 393.39 BTC (valued at approximately $19.2 million), has been directly traced to known darknet markets, ransomware organizations, and other illicit sources. Europol has linked the service to over 15 international cybercrime investigations, including proceeds from the 2022 LastPass breach and the Swissborg hack. The mechanism involved customers transferring stolen cryptocurrency to AudiA6-controlled wallets, with “cleaned” funds typically returned within an hour. The service charged commissions ranging from 3% to 10% for its anonymity-providing services.
The operation relied on an extensive network of over 6,000 fraudulent exchange accounts, often opened using stolen or purchased identities, and utilized money mules, many of whom were Russian-speaking intermediaries, to move criminal proceeds through cryptocurrency exchanges. Undercover agents confirmed that the service knowingly processed funds derived from criminal activities, including drug sales, further solidifying the criminal intent behind the operation.
Investigation Details: A Coordinated Global Effort
The arrest of Ruslan Igorevich Tkachuk is the culmination of a vast and intricate international investigation led by Europol. Key agencies involved included the United States Secret Service, Internal Revenue Service Criminal Investigation (IRS-CI), Eurojust, and the Polish Police. Law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the United Kingdom also played critical roles.
The probe utilized parallel investigations, forensic examination of electronic devices seized from a Ukrainian national arrested in Poland in September 2025, and advanced blockchain analysis tools. Undercover operations were instrumental, with federal agents conducting six transactions between December 2022 and May 2026, documenting operators knowingly soliciting and confirming the criminal origin of funds. This direct evidence provided crucial insight into the inner workings of AudiA6.
The coordinated international action on June 10, 2026, saw searches conducted at three properties in Georgia, the seizure of 25 domains and over 30 servers across multiple countries, the blocking of Telegram accounts, and the freezing of approximately €692,000 ($798,000) in cryptocurrency assets. Additionally, €86,000 ($99,400) in cryptocurrency, 80 vehicles, and several properties were seized in Georgia. The AudiA6 and Dark2Web websites have since been replaced with law enforcement seizure banners, effectively dismantling the core infrastructure of the criminal enterprise.
“This takedown sends a clear message: the perceived anonymity of the dark web and cryptocurrency will not shield criminals from justice. International cooperation is proving increasingly effective in dismantling these sophisticated networks.”
What Happens Next
Ruslan Igorevich Tkachuk remains in the custody of Georgian authorities. The U.S. Attorney’s Office for the Eastern District of Pennsylvania has initiated the process for his extradition to the United States to face the charges of conspiracy to launder monetary instruments and sting money laundering. Should he be convicted of both counts, Tkachuk could face a maximum aggregate sentence of 40 years in federal prison. The investigation is ongoing, and authorities have indicated that further arrests and charges may follow as they continue to unravel the full extent of the AudiA6 network and its associated cybercriminal activities. This case highlights the increasing focus of global law enforcement on related fraud investigations in the cryptocurrency space.
Protecting Yourself: Red Flags to Watch For
The AudiA6 case offers stark warnings for individuals and businesses navigating the digital financial landscape. The explicit advertising of “cryptomixing” services on cybercrime forums like Dark2Web, openly offering to conceal the criminal origins of funds, should immediately raise alarms. High commissions (3-10%) for anonymity are a hallmark of illicit financial services.
Furthermore, the reliance on thousands of fraudulent Know Your Customer (KYC) verified accounts and recruited money mules to obscure transactions should be a significant red flag for cryptocurrency exchanges and financial institutions. The direct connection of AudiA6 operators to and administration of cybercrime forums like Dark2Web also clearly signaled their involvement in broader illicit activities. Prior reports from intelligence firms and blockchain investigators had already exposed AudiA6 for facilitating illegal activity, underscoring the importance of due diligence and vigilance against services promising guaranteed anonymity in financial transactions.
