The U.S. and international partners have arrested two men in Georgia accused of running a cryptocurrency laundering service that moved roughly $389 million, seized infrastructure and assets, and are pursuing extradition and prosecution in federal court.
Federal authorities say Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25, were arrested in Batumi, Republic of Georgia, on criminal complaints charging them with conspiracy to launder monetary instruments and sting money laundering. Officials allege the pair operated a service known as “AudiA6” that hid the origins of cryptocurrency for clients who paid fees of up to five percent.
The takedown was coordinated across continents, with the United States Secret Service and IRS Criminal Investigation working alongside Europol, Eurojust, and law enforcement from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Poland, Switzerland, and the United Kingdom. Authorities targeted infrastructure, froze assets, and disrupted the communications channels the network used to operate.
Law enforcement reports that actions taken during the operation included searches of three properties and the seizure of servers and domains linked to the criminal network in the United States, Iceland, Germany, and France. Telegram accounts used by the alleged laundering network were blocked, cryptocurrency wallets were frozen, and digital devices were taken for forensic analysis.
- Three properties were searched
- Servers and domains linked to the criminal infrastructure were targeted in the United States, Iceland, Germany, and France
- Telegram accounts used by the network were blocked
- Cryptocurrency assets were frozen and digital devices were seized
- Clear web and dark web sites associated with the service were replaced with a law enforcement seizure banner
The criminal complaint describes “AudiA6” as a senior-operated laundering service advertised on the Dark2Web forum, where the service offered to conceal and disguise the source of customers’ cryptocurrency that would otherwise be traceable to criminal activity. Investigators say those advertisements were explicit about the service’s purpose and fee structure.
Using blockchain analysis, investigators traced approximately 10,333 Bitcoin (“BTC”) that flowed into AudiA6 wallets since the service launched in 2021. At the time of the transactions, those deposits were valued at about $389,747,417, and law enforcement mapped many of those funds back to illicit sources using transaction histories and financial records.
Authorities report that about 393.39 BTC, valued at around $19,234,331 at the time, came directly from darknet markets, ransomware operators, cybercrime services, and other known criminal sources. Additional sums were allegedly routed indirectly from illicit accounts into AudiA6 wallets, complicating the money trail but leaving forensic traces on the blockchain.
Tkachuk, a Ukrainian national, and Ledenev, a Russian national, remain in Georgian custody while U.S. prosecutors seek their extradition to the Eastern District of Pennsylvania. If convicted, each faces a maximum statutory sentence of 20 years in prison for the charges outlined in the criminal complaint.
The investigation was led by the Secret Service’s Cyber Investigative Section with assistance from offices in Frankfurt and Oklahoma City, along with IRS-CI. Prosecutors on the case include Assistant United States Attorneys Benjamin D. Traster and Sima Kazmir, and Special Assistant United States Attorney Richard Lorenz.
The U.S. Attorney’s Office for the Southern District of Ohio and the Justice Department’s Office of International Affairs contributed significant support, while the International Computer Hacking and Intellectual Property (ICHIP) prosecutor in The Hague offered technical and prosecutorial assistance. The Justice Department notes that ICHIP coordinates cybercrime technical help for foreign law enforcement and judicial partners.
Officials emphasized that criminal websites seized during the operation now display law enforcement seizure notices in place of the illicit service pages. Those seizure banners are intended to both disrupt ongoing criminal use and signal that the infrastructure has been commandeered by authorities.
The charges in the complaint are allegations, and standard legal protections apply; every defendant is presumed innocent unless proven guilty in a court of law. The case remains active as investigators continue forensic analysis and pursue legal avenues to bring the matter before a federal court.
