**BidenCash Dark Web Market Seized in International Law Enforcement Operation**
U.S. law enforcement, in collaboration with international partners, has seized multiple domains linked to BidenCash, a notorious dark web marketplace specializing in stolen credit cards, personal data, and SSH access. The operation, led by the U.S. Secret Service (USSS) and the FBI, included support from the Dutch National Police, The ShadowServer Foundation, and Searchlight Cyber.
Visitors to BidenCash’s dark web domain are now redirected to a USSS seizure page, confirming the takedown as part of a broader crackdown on cybercrime. According to security researcher g0njxa, even the marketplace’s clear web domain (on a .asia TLD) has been seized, though some reports indicate residual domains may still be active.
A Department of Justice (DoJ) press release revealed that the operation confiscated 145 domains and associated cryptocurrency tied to BidenCash. Since its launch in 2022, the marketplace generated over $17 million in revenue, serving 117,000 customers and facilitating the sale of 15 million payment card numbers alongside personally identifiable information.
BidenCash emerged following the shutdown of Joker’s Stash and other major carding markets, quickly gaining notoriety through high-profile data leaks. In June 2022, it released a database containing 6,600 credit cards and millions of email addresses. By October 2022, it dumped 1.2 million credit cards, primarily from U.S. users, with expiration dates spanning 2023–2026. Two additional leaks in 2023 exposed over 4 million cards combined.
While such marketplaces often attempt to resurface, seizures like this disrupt cybercriminal operations. The USSS, which has been actively targeting financial fraud, recently conducted a sweep in May 2024, inspecting 411 businesses for illegal skimming devices, recovering 17 skimmers and preventing an estimated $5 million in potential losses.
Searchlight Cyber cybersecurity rating report: https://www.rankiteo.com/company/searchlight-cyber
"id": "SEA1766549717",
"linkid": "searchlight-cyber",
"type": "Breach",
"date": "12/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '117,000+ customers',
'industry': 'Cybercrime',
'location': 'Global (domains seized by U.S. '
'authorities)',
'name': 'BidenCash',
'type': 'Dark Web Marketplace'}],
'data_breach': {'number_of_records_exposed': 'Over 15 million payment card '
'numbers',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Payment card numbers',
'Personally identifiable '
'information']},
'date_publicly_disclosed': '2024-06-04',
'description': 'Law enforcement seized multiple domains of BidenCash, a dark '
'web market for stolen credit cards, personal information, and '
'SSH access. The domains now redirect to the U.S. Secret '
"Service's seizure page as part of an international operation.",
'impact': {'data_compromised': 'Over 15 million payment card numbers and '
'personally identifiable information',
'financial_loss': '$17 million in revenue generated since 2022',
'identity_theft_risk': 'High',
'operational_impact': 'Shutdown of BidenCash marketplace '
'operations',
'payment_information_risk': 'High',
'systems_affected': 'BidenCash marketplace domains (clearweb and '
'darknet)'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
'investigation_status': 'Ongoing',
'motivation': 'Financial Gain',
'post_incident_analysis': {'corrective_actions': 'Domain and cryptocurrency '
'seizure, law enforcement '
'action',
'root_causes': 'Illegal trafficking of stolen '
'payment card data and personally '
'identifiable information'},
'references': [{'date_accessed': '2024-06-04', 'source': 'BleepingComputer'},
{'date_accessed': '2024-06-04',
'source': 'U.S. Department of Justice'}],
'regulatory_compliance': {'legal_actions': 'Domain seizure, criminal charges '
'against administrators',
'regulations_violated': ['Illegal trafficking of '
'payment card data',
'Identity theft '
'facilitation']},
'response': {'communication_strategy': 'Public press release and seizure '
'banner on domains',
'containment_measures': 'Domain seizure, cryptocurrency seizure',
'law_enforcement_notified': 'Yes (U.S. Secret Service, FBI, '
'Dutch National Police)',
'third_party_assistance': 'The ShadowServer Foundation, '
'Searchlight Cyber'},
'threat_actor': 'BidenCash Administrators',
'title': 'Seizure of BidenCash Dark Web Marketplace Domains',
'type': 'Domain Seizure'}