BidenCash Darknet Site Dismantled After Trafficking Over 15M Stolen Credit Cards

The US Attorney’s Office for the Eastern District of Virginia has seized 145 web domains and cryptocurrency assets tied to BidenCash, a darknet marketplace notorious for trafficking in stolen credit card data and personal information.

BidenCash began operations in March 2022, stepping in to replace Joker’s Stash, which had been shut down about a year before.

Feds Strike BidenCash Marketplace

Launched in March 2022, BidenCash marketed itself as a one-stop shop for cybercriminals seeking to buy and sell compromised financial data, including millions of payment card numbers and user credentials. The marketplace gained notoriety for its brazen promotional tactics, most notably, a mass leak of 3.3 million stolen credit cards between late 2022 and early 2023, which it offered for free to attract more users.

With a customer base exceeding 117,000, BidenCash is believed to have processed over 15 million compromised records and amassed more than $17 million in revenue through transaction fees.

According to the official press release, federal authorities say the operation’s infrastructure has now been dismantled: the seized domains have been rerouted to law enforcement-controlled servers to disrupt any further illicit activity.

Meanwhile, prosecutors also confirmed that cryptocurrency assets linked to the platform’s illegal profits were confiscated following court approval. The marketplace not only monetized stolen card data but also distributed login credentials that could enable unauthorized remote access to computers.

Operation RapTor

The takedown of BidenCash is yet another addition to an increased crackdown on cybercriminal marketplaces, coming just days after the historic Operation RapTor, the international operation that targeted fentanyl trafficking via the dark web.

This resulted in 270 arrests and over $200 million in asset seizures, including narcotics, cryptocurrency, and firearms. Coordinated across ten countries, RapTor leveraged intelligence from previously dismantled markets like Nemesis and Bohemia, which were crucial in tracking down offenders. Notably, Iranian national Behrouz Parsarad, who happens to be the founder of Nemesis, was sanctioned and indicted, marking the first time the Office of Foreign Assets Control (OFAC) played a direct enforcement role under JCODE.