DoJ seizes 145 domains tied to BidenCash, a marketplace for stolen credit card data

The U.S. Department of Justice (DoJ), in coordination with international law enforcement, announced Wednesday the takedown of BidenCash, a sprawling illicit marketplace for stolen credit card data. The operation seized 145 websites and cryptocurrency assets connected to the platform, disrupting a network that facilitated the sale of over 15 million compromised payment cards since 2022.

“The operators of the BidenCash marketplace used the platform to simplify the process of buying and selling stolen credit cards and associated personal information,” the DoJ said in a statement. “They charged fees for each transaction conducted through the site.”

The rise of BidenCash

BidenCash was launched in March 2022 to fill the vacuum left by the dismantling of other notorious carding sites such as Joker’s Stash and UniCC. The platform operated on both clearnet and dark web domains like bidencash[.]ws and bidencash[.]asia. Within three years, the site had grown to serve more than 117,000 customers, earning at least $17 million in illicit proceeds.

To attract users, BidenCash infamously published millions of stolen credit card records for free, including one dump in February 2023 that exposed 2.1 million credit cards. Half of these belonged to US-based victims and exposed full card details, CVVs, account holder names, physical addresses, emails, and phone numbers.

Beyond credit card fraud, the marketplace offered compromised credentials and SSH access to vulnerable servers, sometimes as cheaply as $2. Buyers could purchase not just stolen access, but packages that scanned servers for shell access, processing power, geolocation, and known vulnerabilities.

“This posed a significant risk as threat actors could use these tools for data theft, ransomware deployment, and cryptocurrency mining,” cybersecurity firm CloudSEK warned in a 2023 report.

The fall of BidenCash

The DoJ did not disclose the value of the confiscated cryptocurrency funds, nor did it identify the operators of BidenCash or their physical locations. However, the seizure banner indicates that this operation was part of a larger international effort. The U.S. Secret Service and the Federal Bureau of Investigation (FBI) led the initiative, in partnership with the Dutch Politie, the Shadowserver Foundation, and Searchlight Cyber.

The takedown comes amid a broader international push against cybercrime infrastructure. Just days ago, authorities dismantled three of the most prolific malware operations, striking blows against the Lumma Stealer, DanaBot, and Qakbot networks.