The AudiA6 Crypto Mixer Case: Money Laundering Charges Under 18 U.S.C. § 1956 and the Attribution Defense
The AudiA6 Crypto Mixer Case: Money Laundering Charges Under 18 U.S.C. § 1956 and the Attribution Defense
On June 2, 2026, prosecutors in the Eastern District of Pennsylvania filed a criminal complaint against Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev. Agents arrested both men on June 10 in Batumi, Republic of Georgia. On June 12, the Justice Department announced the charges and a coordinated international takedown of the AudiA6 cryptocurrency mixing service and the Dark2Web cybercrime forum. See the announcement from the U.S. Attorney’s Office.
Two counts are charged. Conspiracy to launder monetary instruments. And sting money laundering. The public record is a 32-page affidavit sworn by a United States Secret Service special agent. It sets out how the government built the case.
Why the Case Fits Current Enforcement Priorities
The Justice Department has narrowed its cryptocurrency enforcement. An April 2025 memorandum from the Deputy Attorney General instructed prosecutors to stop charging digital asset cases premised on regulatory violations. That includes operating an unlicensed money transmitting business and failing to maintain an anti-money laundering program, unless the government can prove the defendant knew of the requirement. The memo told prosecutors to focus on defendants who use digital assets to further other crimes, such as drug trafficking, ransomware, and organized crime.
The AudiA6 charges track that policy. The government did not charge the operators as unlicensed money transmitters. It charged them as launderers who agreed to conceal the proceeds of ransomware, fraud, and narcotics trafficking. That choice keeps the case within the Department’s current charging guidance.
The case also reflects a shift toward prosecuting the infrastructure of cybercrime. Mixers, forums, and cash-out networks are now the targets, not only the underlying thefts. The 2023 prosecutions of the Tornado Cash and Samourai Wallet developers began that trend. AudiA6 continues it.
The Two Charges
Each count has distinct elements. Each faces different defenses.
Conspiracy to Launder Monetary Instruments
The first count is conspiracy under 18 U.S.C. § 1956(h). The government must prove an agreement between two or more people to commit a money laundering offense, and that the defendant joined it knowing its unlawful object. Section 1956(h) has no separate overt-act requirement. The Supreme Court confirmed that in Whitfield v. United States, 543 U.S. 209 (2005). The agreement itself is the crime.
The proof of agreement here is largely circumstantial. It rests on shared server infrastructure, a common backup storage box, overlapping monikers, and administrative records that mix AudiA6 and Dark2Web files.
Sting Money Laundering
The second count is sting money laundering under 18 U.S.C. § 1956(a)(3)(B). This count rests on the undercover transactions. The government must prove the defendant conducted a financial transaction involving property that a law enforcement officer represented to be proceeds of specified unlawful activity, with intent to conceal or disguise the nature, location, source, ownership, or control of that property.
In a sting count the funds need not be real criminal proceeds. It is enough that an agent represented them as proceeds and the defendant went forward with intent to conceal. That is why the recorded chats carry the case. They supply both the representation and the intent.
The $389 million figure describes total deposits traced to AudiA6 wallets. The charged conduct is six undercover transactions worth about $23,000. A conviction on the sting count does not require proof that a single real dollar was laundered. It requires proof of what the operator said and intended during those six recorded exchanges.
The Government’s Evidence
The affidavit assembles five categories of proof.
The Undercover Transactions
Between December 2022 and May 2026, undercover agents ran six transactions through AudiA6. In each, agents represented the funds as criminal proceeds and asked whether the service would still mix them. In the first transaction, agents asked in Russian whether they could mix money from ransomware and crypto scams. The operator answered yes. In an April 2026 transaction, agents said the bitcoin was stolen and from a scam. The operator said it did not care.
The May 15, 2026 transaction anchors venue in Philadelphia. Agents there told the operator the funds were profit from selling narcotics on a Russian-language drug market, and that they worked with a partner to distribute. The operator responded that funds like that need to go through a mixer. Distribution of a controlled substance under 21 U.S.C. § 841 is a specified unlawful activity for money laundering purposes.
The Forum Advertisement
The AudiA6 advertisement on Dark2Web is the government’s evidence of purpose. It uses laundering vocabulary. It describes taking “dirty” crypto and returning “clean” crypto. It promises to “cut off your tails.” It advertises an output risk score below the 25 percent threshold at which exchanges freeze transactions. The government will argue the advertisement shows concealment was the object of the service.
The Seized Server and Backups
Iceland provided a copy of the AudiA6 web server to the Secret Service in December 2023 through a mutual legal assistance request. Germany later provided records for a Hetzner storage box holding backups of both AudiA6 and Dark2Web. Those backups included a customer relationship management database, email application records, and an AML risk-scoring table. This is the documentary core of the case.
The Blockchain Tracing
IRS Criminal Investigation analysts traced 10,333 bitcoin into AudiA6 wallets. They identified 393.39 bitcoin as coming directly from darknet markets, ransomware groups, and other illicit sources. The affidavit also states that AudiA6 did not mix funds through separate, unconnected pools as advertised. Transactions could be traced directly through exchange records. The defense will hold the government to that admission.
The Attribution Evidence
The government links Tkachuk to the moniker AudiA6 through a Google account holding his identification documents and files that reference the AudiA6 brand. It links Ledenev to the moniker Azazello through the email used to rent the storage box and test emails sent to AudiA6 domains. Attribution in a case built on monikers and shared servers is rarely airtight.
Where the Defense Attacks
A complaint is not a conviction. It reflects the government’s view of the evidence at the probable cause stage. In this case, the defenses converge on one structural problem. AudiA6 is a brand. It is not a defendant. The government charged two individuals, and every element must be proven against each of them personally.
The Central Defense: Attribution to the Named Individuals
Federal money laundering liability is personal. There is no entity to convict here, and no theory of corporate liability can carry the case. The government cannot convict Tkachuk or Ledenev by proving what “AudiA6” did. It must prove what each man knew and what each man did. The complaint blurs that line. It attributes the advertisement, the transactions, and the intent to a service, then reasons backward to the two men alleged to run it.
Start with the sting count. The complaint does not allege that either defendant conducted any of the six undercover transactions. The chats were with unnamed operators. In the April 2026 exchange, the person on the keyboard said, “I’m just an operator,” and disclaimed knowledge of who ran the forum. The seized CRM database lists 25 employee accounts. The affidavit bridges the gap by asserting that the operator acted in accordance with “organizational policy.” That is an inference by the affiant. It is not an allegation that either named defendant knew of, directed, or took part in the charged transaction.
The government’s route around this problem is aiding and abetting under 18 U.S.C. § 2. That route has its own proof requirements. Under Rosemond v. United States, 572 U.S. 65 (2014), an aider and abettor must take an affirmative act in furtherance of the offense, with advance knowledge of its essential features and the intent to facilitate it. Building infrastructure in 2021 does not aid a May 2026 transaction unless the government proves the defendant knew transactions of that kind were occurring and intended to make them succeed. For the sting count, the essential feature is the agents’ representation that the funds were drug proceeds. No allegation puts that representation in front of either named defendant.
The Inference Chain Behind Each Name
The identity proof also differs for each defendant, and the differences matter.
For Tkachuk, the government connects the moniker AudiA6 to a second moniker, xai, through a phone number embedded in an email address. It then connects that email account to Tkachuk through shopping confirmations, an insurance policy, and identity documents stored in the account. The account was registered under a false name. The affidavit concedes that cybercriminals routinely register accounts under false names. That concession cuts in both directions. An account registered to a fictitious person is an account whose true controller is a matter of proof, not assumption.
For Ledenev, the allegations are thinner. He is tied to infrastructure. A rented storage box held backups of the AudiA6 and Dark2Web servers. His email account exchanged test messages with AudiA6 domains and received search metrics for the forum. The description of “Azazello” as the forum’s technical creator comes from an anonymous 2022 forum post. No allegation places Ledenev in any laundering transaction, in the drafting of the advertisement, or in any communication about criminal proceeds. Maintaining servers is not money laundering. The government must prove he knew what the service did with the funds and agreed to it.
Intent to Conceal
Both counts require concealment intent. The sting count requires that the defendant acted with intent to conceal or disguise the source or ownership of the represented proceeds. Providing an exchange service does not satisfy that element on its own. In Cuellar v. United States, 553 U.S. 550 (2008), the Supreme Court held that concealment laundering requires proof that concealment was a purpose of the transaction, not a byproduct of it. An operator who ran an exchange and took a commission can argue the transactions were commercial. On that view the government has proven a fee, not a design to conceal.
The Advertisement Is Not the Defendant’s Words
Marketing copy on a forum is evidence of the pitch. It does not by itself prove that either named defendant wrote it, believed it, or acted on it in the charged transactions. The advertisement was first posted in 2021 and last edited in 2026. Who edited it, and when, is an open question. The government must tie the advertised intent to the individuals it has charged.
The Government’s Own Tracing Admission
The affidavit concedes that AudiA6 did not mix funds through unconnected pools and that transactions were directly traceable through exchange records. A service that leaves a direct, traceable path is a weak concealment vehicle. The gap between the marketing and the mechanics gives the defense an argument that the concealment element was not met in fact.
Extradition
Tkachuk and Ledenev are in Georgian custody. The United States has said it will seek extradition to the Eastern District of Pennsylvania. That process is not automatic. Georgia will evaluate the request under its extradition treaty and its own law. Neither defendant is a United States citizen. Neither has appeared in a United States court.
Extradition is a separate front. It turns on dual criminality, the posture of the requested state, and the possibility of competing requests from other countries. Contesting extradition is not the same as contesting the charge. The two proceedings are distinct, and the position taken in one affects the other. For a full treatment of fugitive status, Interpol Red Notices, and extradition in fraud cases, see the firm’s analysis of the FBI Most Wanted Fraudsters List and fugitive defense.
The 6,000 Exchange Accounts
The affidavit describes a database listing roughly 6,000 cryptocurrency exchange account logins. It also holds passport scans and selfie photos of the people whose names appear in the tables. The government describes these as fraudulent accounts created to move funds through exchanges without detection.
The reach extends past the two named defendants. Investigators have published the AudiA6 domains so exchanges can identify and block associated accounts. A person whose identity documents or exchange account appears in that data may see account freezes, exchange inquiries, or law enforcement contact. Being named in a seized database is not a charge. It can be the start of exposure.
For background on how the firm handles these matters, see the cryptocurrency fraud and money laundering practice page.
Frequently Asked Questions
What is sting money laundering under 18 U.S.C. § 1956(a)(3)?
Sting money laundering reaches transactions where the funds are supplied or represented by law enforcement rather than being actual criminal proceeds. Under 18 U.S.C. § 1956(a)(3), the government must prove the defendant conducted a financial transaction involving property that a law enforcement officer represented to be proceeds of specified unlawful activity, with one of three statutory intents. Subsection (a)(3)(B) supplies the intent to conceal or disguise the nature, location, source, ownership, or control of the represented proceeds.
The provision lets undercover operations reach launderers even where no real criminal proceeds change hands. Because the property need not be dirty, the government’s proof turns on what agents represented and what the defendant intended in response. Recorded communications are usually central.
Does operating a cryptocurrency mixer violate federal money laundering law?
Operating a mixer is not money laundering on its own. A charge under 18 U.S.C. § 1956 requires a financial transaction involving criminal proceeds or represented proceeds, combined with a specific statutory intent, such as intent to conceal. In Cuellar v. United States, the Supreme Court held that concealment laundering requires proof that concealing the source or ownership of funds was a purpose of the transaction, not an incidental effect.
A separate body of law governs unlicensed money transmitting under 18 U.S.C. § 1960 and the Bank Secrecy Act. Current Justice Department policy directs prosecutors away from charging digital asset cases as regulatory violations unless the defendant knew of the licensing or registration requirement.
What must the government prove for a § 1956(h) money laundering conspiracy?
Under 18 U.S.C. § 1956(h), the government must prove that two or more people agreed to commit a substantive money laundering offense and that the defendant knowingly joined the agreement with intent to further its unlawful object. The statute has no overt-act requirement. The Supreme Court confirmed that in Whitfield v. United States, 543 U.S. 209 (2005).
Because the agreement is the offense, the government often proves conspiracy through circumstantial evidence such as coordinated conduct, shared infrastructure, and communications. Each item of circumstantial proof carries alternative explanations. The government must connect each defendant to the shared unlawful intent, not merely to the enterprise.
Is intent to conceal required for a money laundering conviction?
For concealment money laundering, yes. The concealment prong of 18 U.S.C. § 1956 and the sting provision at § 1956(a)(3)(B) both require intent to conceal or disguise the nature, source, location, ownership, or control of the funds. In Cuellar v. United States, the Supreme Court reversed a conviction where the evidence showed the defendant hid money during transport but did not show that concealment of its source or ownership was a purpose of the transaction.
The element is often contested where a defendant provided a commercial service for a fee. A charged commission can support an argument that the transaction was a sale of a service, which leaves the government to prove concealment as a separate object of the transaction.
What is specified unlawful activity in a money laundering case?
Specified unlawful activity, or SUA, is the set of predicate crimes whose proceeds can support a money laundering charge. The term is defined in 18 U.S.C. § 1956(c)(7). It incorporates a long list of federal offenses and certain state and foreign offenses, including drug trafficking, wire fraud, and offenses tied to ransomware and computer intrusion.
In a sting case under § 1956(a)(3), the government does not prove the funds were actual proceeds of an SUA. It proves the funds were represented by a law enforcement officer to be such proceeds. In the AudiA6 complaint, agents represented the funds as proceeds of narcotics distribution under 21 U.S.C. § 841, a specified unlawful activity.
Can money laundering charges rest on the conduct of a service rather than an individual?
No. When the government charges individuals, liability is personal. A brand or online service is not a defendant, and the conduct of a service cannot be imputed to a person without proof of that person’s own knowledge and acts. In the AudiA6 complaint, the six undercover transactions were conducted with unnamed operators, and the seized database lists 25 employee accounts. The government must connect the named defendants to the charged transactions through their own agreement, direction, or participation.
Where the government proceeds on aiding and abetting under 18 U.S.C. § 2, Rosemond v. United States, 572 U.S. 65 (2014), requires an affirmative act in furtherance of the offense, taken with advance knowledge of its essential features and intent to facilitate it. An inference that an operator followed “organizational policy” describes the service. It does not establish what a specific defendant knew.
How is a defendant tied to an online moniker in a cybercrime forum case?
Attribution connects an online identity to a person. In forum cases, the government builds attribution through a chain of inferences. It links monikers across forums, traces recovery emails, matches phone numbers, and analyzes shared server and backup infrastructure. Each link is an inferential step rather than direct proof. Accounts registered under false names, a practice the AudiA6 affidavit itself acknowledges, leave the true controller of an account as a question of proof.
The strength of an attribution case depends on whether each inference holds and whether innocent explanations exist. A shared hosting arrangement, a reused email address, or a common backup service can carry a non-criminal explanation. The government must tie each named defendant to the charged mental state, not only to the infrastructure. Gaps between the enterprise and the individual are a common focus of litigation.
How does the $389 million figure relate to the charges in the AudiA6 case?
The $389 million figure describes the total bitcoin, valued at roughly $389.7 million at the time of the transactions, that blockchain analysts traced into AudiA6 wallets since 2021. The affidavit identifies about $19.2 million of that total as received directly from known illicit sources.
The charged counts do not rest on the full sum. The conspiracy count under 18 U.S.C. § 1956(h) charges an agreement to launder. The sting count under § 1956(a)(3)(B) rests on six undercover transactions worth about $23,000. The larger figure bears on sentencing and on the government’s narrative. A conviction on the sting count depends on the recorded undercover exchanges.
How does extradition work when defendants are arrested abroad?
When a defendant is arrested in another country, the United States must request extradition and the requested state decides whether to grant it. The analysis usually turns on the terms of the applicable extradition treaty, the requirement of dual criminality, and the procedures of the requested state’s courts. Competing requests from other countries can also affect the outcome.
Tkachuk and Ledenev were arrested in Batumi, Republic of Georgia, and the United States has stated it will seek their extradition to the Eastern District of Pennsylvania. Extradition proceedings are separate from the merits of the charge. A defendant can contest extradition without addressing guilt, and the posture taken in the extradition proceeding can shape the criminal case that follows.
What experience does Armstrong & Bradylyons PLLC bring to cryptocurrency money laundering cases?
Scott Armstrong served as an Assistant Chief in the Market Integrity and Major Frauds Unit at the Justice Department’s Fraud Section. He tried sixteen federal jury trials, including the first cryptocurrency market manipulation case charged under Title 15, a multi-week trial involving over $300 million in spoof and wash trades. He prosecuted the undercover operations, blockchain tracing, and attribution evidence that cases like AudiA6 are built on.
Drew Bradylyons served as Chief of the Financial Crimes and Public Corruption Unit at the U.S. Attorney’s Office for the Eastern District of Virginia and as an Assistant Chief in the Fraud Section’s Health Care Fraud Unit. He supervised cryptocurrency Ponzi scheme prosecutions with hundreds of millions of dollars in losses. Together, the firm’s attorneys have over 25 years of combined Justice Department experience and 25 federal jury trials. They defend individuals and companies in cryptocurrency fraud and money laundering matters in every federal district.
