BidenCash seized: how the card shop that gave away millions of stolen cards finally fell
On June 4, 2025, anyone opening one of the busiest storefronts on the dark web for stolen credit cards found something else entirely. A seizure banner, stamped with the seals of the Department of Justice, the FBI and the US Secret Service, announced that BidenCash was closed for business.
A card shop that gave its product away
BidenCash launched in March 2022, stepping into the vacuum left when Joker's Stash shut down and Russian authorities seized rivals like UniCC and Trump's Dumps. From day one, its operators courted attention with giveaways instead of discretion. The site started small, leaking a database of 6,600 cards in June 2022. Three months later came a far louder stunt: a free dump of 1.2 million credit cards, complete with card numbers, CVVs, holder names, addresses and email accounts, pushed out on hacking forums to promote freshly launched shop domains (BleepingComputer). Italian researchers at D3Lab first flagged that giveaway and cross-checked samples with several banks, confirming the data mapped to real cardholders. Roughly 30 percent of the entries appeared fresh, which meant hundreds of thousands of still-usable cards circulating at zero cost. For its first anniversary in February 2023, BidenCash released another 2.1 million records, many traced back to web skimmers planted on compromised online stores. According to prosecutors, the shop handed out 3.3 million stolen cards for free between October 2022 and February 2023 alone (DOJ). Fraud, it turned out, could be marketed like any other product.How the takedown happened
The operation was announced by the US Attorney's Office for the Eastern District of Virginia. Investigators seized approximately 145 darknet and clearnet domains tied to the marketplace, along with the cryptocurrency wallets BidenCash used to collect its illicit proceeds. The investigation was led by the Secret Service's Cyber Investigative Section and its Frankfurt Resident Office, working alongside the FBI's Albuquerque Field Office. The Dutch National High Tech Crime Unit, the nonprofit Shadowserver Foundation and the threat intelligence firm Searchlight Cyber provided support (Secret Service). Searchlight Cyber separately confirmed it supplied technical capabilities for the government action. Visitors to the seized addresses are now silently redirected to usssdomainseizure.com, a server under US law enforcement control (Searchlight Cyber). No arrests were announced."Between October 2022 and February 2023, the BidenCash marketplace published 3.3 million individual stolen credit cards for free to promote the use of their services." - US Attorney's Office, Eastern District of Virginia
The scale behind the banner
Official figures sketch an enormous enterprise. BidenCash counted more than 117,000 customers, trafficked over 15 million payment card numbers with attached personal data, and generated at least $17 million in revenue across three years of operation. Administrators charged a fee on every transaction, yet individual records sold for as little as 15 cents. The shop also peddled compromised credentials and SSH access that buyers could use to break into computers outright (SecurityWeek). The financial squeeze extended on-chain as well. Blockchain analysts watched wallet balances linked to the marketplace move into accounts labeled as seized funds after courts authorized the crypto seizure, though the full total has not been disclosed.What makes card shops different from classic markets
BidenCash was never a general-purpose darknet market in the mold of AlphaBay or Hydra, where independent vendors flogged drugs, weapons and forged papers. It belonged to a narrower species: the card shop, specialized in payment data and run like a retail operation. Instead of vendor listings and escrow disputes, card shops offer searchable inventories of individual records, usually with automated validity checks so buyers do not pay for dead plastic. Supply flows mainly from web skimmers injected into checkout pages and from info-stealing malware, not from third-party sellers. That structure shapes enforcement, too. Takedowns of classic markets often hinge on undercover buys and server raids, while card shops are exposed through their sprawling domain portfolios. BidenCash alone maintained dozens of mirrors across both the clearnet and Tor, and every one was a potential seizure target.After the banner goes up
Within days, researchers noted that a handful of mirror domains were still resolving, a familiar pattern after dark web seizures. Domain takeovers disrupt infrastructure, but they rarely remove the operators themselves. Analysts expect successors to surface, much as BidenCash once rose from the wreckage of Joker's Stash. For consumers, the checklist barely changes:- Review card statements monthly and dispute unfamiliar charges immediately
- Prefer tokenized wallets or single-use virtual cards at checkout
- Treat unsolicited password reset emails and phishing lures seriously, since leaked emails fuel follow-up scams