BidenCash Carding Marketplace Dismantled in Global Law Enforcement Operation

Global law enforcement agencies, led by the U.S. Department of Justice, have successfully dismantled BidenCash, a prominent dark web carding marketplace. The operation involved the seizure of 145 domains and cryptocurrency funds, significantly disrupting the illicit trade of stolen credit card data and personal information that had generated over $17 million in revenue.

BidenCash: A Notorious Carding Hub Shut Down

BidenCash, which emerged in March 2022 following the shutdown of other major carding forums like Joker's Stash and UniCC, quickly rose to prominence in the cybercrime underworld. Unlike many dark web marketplaces, BidenCash operated on both the clearnet and dark web, making it easily accessible and contributing to its rapid growth. The platform facilitated the buying and selling of stolen credit card numbers, expiration dates, CVV numbers, account holder names, addresses, email addresses, and phone numbers.

Key Takeaways

• Extensive Reach: BidenCash served over 117,000 customers and trafficked more than 15 million payment card numbers and associated personal information.

• Significant Revenue: The marketplace generated an estimated $17 million in illicit revenue during its operation.

• Aggressive Promotion: BidenCash administrators frequently leaked millions of stolen credit card details for free as a marketing strategy to attract new users. Notable leaks include:3.3 million cards between October 2022 and February 2023.Over 2 million cards in March 2023 as part of its anniversary promotion.1.6 million cards in plaintext in December 2023.1 million payment card numbers in April 2025.

• Broader Criminal Services: Beyond carding, BidenCash also offered compromised credentials and advertised SSH services, enabling other malicious activities like data exfiltration, brute-force attacks, ransomware, and cryptocurrency mining.

The Takedown Operation

The coordinated international effort saw the seizure of approximately 145 clearnet and dark web domains associated with BidenCash. Visitors to these domains are now redirected to a seizure banner controlled by U.S. law enforcement. Authorities also obtained court orders to seize cryptocurrency funds generated from the illegal sales.

The operation was a collaborative effort involving:

• U.S. Department of Justice (DoJ)

• Federal Bureau of Investigation (FBI)

• U.S. Secret Service

• Dutch Politie (Dutch National High Tech Crime Unit)

• The Shadowserver Foundation

• Searchlight Cyber

While the takedown is a significant victory against cybercrime, authorities have not yet disclosed the value of the confiscated cryptocurrency funds or identified the operators of BidenCash. The focus now shifts to identifying and apprehending the administrators and affiliates of the marketplace.

Implications for Victims and Future Outlook

The immediate impact for victims of BidenCash may not be apparent, as many cardholders whose data was compromised could still be vulnerable. Consumers and businesses are strongly advised to:

• Monitor their accounts closely.

• Utilize two-factor authentication.

• Consider freezing credit if they suspect any prior compromise.

This successful operation underscores the ongoing commitment of global law enforcement to combat cybercrime. While BidenCash has been dismantled, the underlying criminal ecosystem remains. However, the public nature of this takedown serves as a clear message that such illicit activities will not go unpunished.

As cyber threats become increasingly sophisticated, your security strategy must evolve to keep pace. BetterWorld Technology offers adaptive cybersecurity solutions that grow with the threat landscape, helping your business stay secure while continuing to innovate. Reach out today to schedule your personalized consultation.

Sources

• DoJ Seizes 145 Domains Tied to BidenCash Carding Marketplace in Global Takedown, The Hacker News.

• Feds Seize BidenCash Carding Market and Its Crypto Profits, Hackread.

• Carding Marketplace BidenCash Shut Down by Authorities, SecurityWeek.