In a significant move against cybercrime, the U.S. Department of Justice (DoJ) announced on June 5, 2025, the seizure of approximately 145 domains associated with the illicit carding marketplace known as BidenCash. This operation also included the confiscation of cryptocurrency funds linked to the platform.
BidenCash emerged in March 2022, filling the void left by the shutdown of previous carding forums like Joker’s Stash and UniCC. The marketplace facilitated the buying and selling of stolen credit card information and associated personal data, charging a fee for each transaction conducted on the site.
Since its inception, BidenCash has reportedly supported over 117,000 customers and facilitated the trafficking of more than 15 million payment card numbers and personally identifiable information. The platform is estimated to have generated at least $17 million in revenue through these illicit activities.
To promote its services, BidenCash published 3.3 million stolen credit card records for free between October 2022 and February 2023. These records included sensitive information such as credit card numbers, expiration dates, Card Verification Value (CVV) numbers, account holder names, addresses, email addresses, and phone numbers. Notably, of the 2.1 million compromised credit cards released in February 2023, 50% belonged to U.S.-based individuals or entities.
In addition to selling stolen credit card data, BidenCash specialized in offering compromised credentials that allowed other cybercriminals to gain unauthorized access to computers. Reports from May 2023 indicated that the marketplace began advertising Secure Shell (SSH) services to buyers for as low as $2. These services included packages that assessed target servers for the presence of shells, provided information about processing power, location, and identified security vulnerabilities. Such offerings posed significant risks, enabling threat actors to conduct a range of malicious activities, including data exfiltration, brute force attacks, ransomware deployment, and cryptocurrency mining.
The crackdown on BidenCash was part of an international effort led by the U.S. Secret Service and the Federal Bureau of Investigation (FBI), in collaboration with the Dutch Politie, the Shadowserver Foundation, and Searchlight Cyber. While the authorities did not disclose the exact value of the confiscated cryptocurrency funds or the identities and locations of the BidenCash operators, this operation underscores the ongoing commitment to dismantling cybercriminal infrastructures and protecting individuals from identity theft and financial fraud.
