Targeting Illicit Crypto Flows: Searchlight Cyber Supports Law Enforcement Takedown of AudiA6 Crypto-Mixer

On June 10th, Searchlight Cyber supported a successful coordinated law enforcement operation targeting AudiA6, a notorious Russian cryptocurrency mixing service. By providing specialized technical capabilities, we helped disrupt a critical node used by criminals to obfuscate and launder illicit funds.

The AudiA6 Threat

AudiA6 was a crypto-mixer designed by criminals to launder cryptocurrency. Rather than operating as a standard exchange, it functioned as a high-risk laundering and obfuscation service, known for charging exorbitant flat service fees between 3% and 5.5%. Historically, the service allowed a maximum mixing amount of 27 BTC (worth approximately $1.7 million back in 2021).

AudiA6 has been linked to laundering flows from the fake Ledger app incident reported in April 2026, where a malicious Ledger Live clone on Apple’s App Store reportedly drained around $9.5 million in crypto from about 50 victims over a short campaign window. Public reporting attributed to ZachXBT says the stolen funds were dispersed through more than 150 KuCoin deposit addresses before flowing into AudiA6’s centralized mixing service.

The largest reported single victim loss in the fake Ledger campaign was approximately $3.23 million in USDT, with “several other” individual losses reportedly exceeding $1 million.

A separate, highly publicized victim case involved musician G. Love, who reported losing approximately 5.9 BTC / 5.92 BTC, valued in public reporting at roughly $420,000–$424,000, after downloading a fake Ledger app and entering his recovery phrase. Those funds were reportedly moved through KuCoin-linked deposit addresses.

Why Disrupting Mixers Matters

Crypto mixers like AudiA6 are heavily abused by malicious actors to break the visible link between criminal proceeds and their ultimate destination wallets. These services are the lifeblood of serious financial crime typologies, regularly facilitating laundering activity, sanctions evasion, ransomware payouts, dark web market revenue, and widespread fraud.

Disrupting this infrastructure serves a dual purpose: it denies criminals a vital laundering capability while simultaneously generating critical intelligence for further investigations. Operations of this scale are essential to protecting victims, regulated financial institutions, digital-asset businesses, and the broader cryptocurrency ecosystem.

The Power of Public-Private Collaboration

This takedown perfectly demonstrates the value of public-private collaboration in tracking and disrupting illicit crypto flows. Since our founding in 2017, we have supported law enforcement across the globe in tackling serious organized crime, with our tools used in some of the largest dark web investigations: In 2025, we assisted in the U.S. government takedown of the notorious dark web marketplace BidenCash.

The takedown of AudiA6 reinforces a powerful message that crypto anonymity services are not beyond the reach of lawful investigation.