Illicit Carding Hub BidenCash Dismantled in Major Takedown

U.S. law enforcement has seized approximately 145 darknet and clearnet domains, along with cryptocurrency holdings linked to BidenCash, a notorious carding marketplace that facilitated the distribution of stolen credit card data and personal information. Since its inception in March 2022, the platform served over 117,000 users and trafficked more than 15 million payment card records, reportedly generating at least $17 million in illicit revenue.

BidenCash gained traction by periodically publishing stolen data sets—for example, offering 3.3 million credit card records free of charge between October 2022 and February 2023—as a marketing tactic to lure new buyers. These leaks included full card numbers, expiry dates, CVV codes, account holder names, addresses, email IDs and phone numbers. Beyond carding, the platform also traded compromised credentials which could be used for unauthorised computer access.

By court order, U.S. authorities have seized cryptocurrency wallets used by BidenCash to collect illicit proceeds. On‑chain intelligence from Arkham Intelligence indicates that around $43,000 in USDT was transferred to wallets designated as “Seized Funds”, although the total seizure remains undisclosed.

Visitors to the seized domains are now automatically redirected to servers controlled by U.S. law enforcement and are greeted with official seizure banners bearing logos of the Department of Justice, FBI, U.S. Secret Service and involved international partners.

The dismantling of BidenCash resulted from a joint operation involving the U.S. Attorney’s Office for the Eastern District of Virginia, the Secret Service, the FBI and international partners including the Dutch National High Tech Crime Unit, the Shadowserver Foundation and Searchlight Cyber. While no arrests have been confirmed publicly, the takedown highlights expanded cooperation between U.S. and European agencies.

Cybersecurity analysts warn that some traces of BidenCash remain active. As of early June, researchers such as Vmprotect identified at least seven live domains tied to the marketplace, illustrating the inherent challenges in fully eradicating darknet infrastructure.

Experts highlight that even expired credit cards and outdated personal data can fuel phishing schemes, identity theft and account takeovers, underscoring the enduring risks for victims.

The crackdown on BidenCash forms part of a broader escalation by global law enforcement in their fight against cybercrime malign platforms. Recent operations have targeted malware-as-a-service networks, counter‑antivirus services and other darknet commerce sites. Yet analysts caution that such efforts often spark rapid migration of criminal activity to new domains and platforms.

Investigators are now focusing on tracing the individuals behind the BidenCash operation and pursuing further legal actions to freeze remaining assets. Analysts emphasise that the success of this takedown will depend on follow‑through investigations and the dismantling of successor networks.