AudiA6 Mixing Service
Summary
AudiA6 is a centralized cryptocurrency mixing and exchange service, documented by security researchers and blockchain investigators as a vehicle for laundering illicit funds. In May 2026, blockchain investigator ZachXBT identified AudiA6 as the mixing service used to launder approximately $9.5 million in cryptocurrency stolen from victims of a counterfeit Ledger Live application on the Apple App Store, routing proceeds through more than 150 KuCoin deposit addresses. The service has no known OFAC designation as of May 2026 but maintains an established presence on criminal carding and cracking forums.
Connected Entities
1 entities · 10 linked investigationsTimeline(6 events)
2021-11-01
Intel 471 and BleepingComputer publish research identifying AudiA6 as one of four cryptomixing services most widely used by cybercriminals in the underground ecosystem, alongside Absolutio, Blender, and Mix-btc.
BleepingComputer / Intel 4712026-04-07
A counterfeit Ledger Live application ('Leva Heal' publisher) begins harvesting seed phrases from victims on the Apple App Store. Theft campaign runs through approximately April 13, 2026.
CoinDesk2026-04-08
Largest single theft day: one victim loses $1.95 million including 20.64 BTC, 211 stETH, and 70 ETH. A second victim loses $3.23 million in USDT on April 9.
Bitcoin.com News2026-04-14
ZachXBT publishes investigation on Telegram, tracing $9.5 million in stolen crypto through more than 150 KuCoin deposit addresses connected to the AudiA6 mixing service. Apple removes the counterfeit Ledger Live app from the App Store.
CoinDesk2026-04-20
KuCoin's freeze of suspect accounts linked to the laundering operation is reported to have been set to expire unless extended by formal law enforcement request.
AppleInsider2026-05-22
ZachXBT publishes a follow-up report alleging KuCoin ignored repeated appeals from hack victims and police, and accuses the exchange of shielding more than $13 million in recently stolen crypto. AudiA6 is identified as the centralized mixer used to facilitate the laundering.
BanklessTimesDecision Log
- hash: A2K7zDdt6Snt4EGzK38ypipPF7hJUqrnhVcA6fZ6A8Gg
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 5/28/2026, 6:37:41 PM
last updated: 5/28/2026, 6:37:57 PM
avoid.net — verified advice for a post-truth world