Many online marketplaces now accept cryptocurrency in exchange for hundreds of millions of stolen credit cards from e-commerce sites, banks, and payment processors. Having acquired a fortune of over $1 billion, the founder of Joker’s Stash, one of the most prominent carding markets, has reportedly retired. Each time you use a credit or debit card to make a purchase, the information from your card is sent to a server and stored there. Obtaining these card information is a driving factor in many significant retail and company hacks.

Cards that have been stolen are valuable because they can be used to buy expensive goods or gift cards that can be resold for a profit. Carding describes this technique, which has become an important tool for cybercriminals. Although the profits from carding are substantial in and of themselves, the practise is also put to use in the laundering and withdrawal of bitcoin stolen in other cybercrime operations.

Joker’s Stash: Where All the Cards Are Kept

In the past six years, Joker’s Stash has expanded to become the primary marketplace for fraudulent personal information and stolen credit cards. It’s a carding AVC (automated vending trolley) like this one that facilitates the rapid purchase, sorting, and delivery of massive quantities of cards in exchange for Bitcoin. You can see how these cards are organised and searchable by nation, bank, expiration date, and other criteria in the image below. Single cards on Joker’s Stash can be purchased for anything from $1 to $150, with the more expensive options including the buyer’s full name, address, and SSN.

The doors of Joker’s Stash first opened in 2014. Using the alias “JokerStash,” the site’s creator made announcements about the opening of the site on several carding forums in both English and Russian. The marketplace’s success can be attributed to the high standard and wide selection of the cards it sells, all of which come from a network of “partners” that are actually criminal organisations that stole the information in the first place. Cards stolen in large-scale data breaches were announced weeks in advance with mysterious codenames. For instance, the “DAVINCI BREACH” promoted itself to two million credit cards belonging to consumers of US restaurant chain “Buca di Beppo,” while the “BIGBADABOOM-2” batch of five million cards likely originated from retailer Saks Fifth Avenue.

Utilizing data analytics on the blockchain to predict sales volumes

Joker’s Stash’s revenue may be roughly calculated by looking at the amount of cryptocurrency sent to its wallet, which can be verified on the blockchain. Since 2015, about $400 million worth of bitcoin have been sent to the market, with 2018 seeing the highest annual sales at $139 million. There was a decline in sales over the next two years, which mirrored a general decline in carding activity as better protections against card theft and anti-fraud tools made it harder for criminals to use stolen cards.

This decline in carding activity could be a contributing factor to the recent announcement of Joker’s Stash’s permanent closure. In October, JokerStash informed consumers that he or she had been hospitalised for more than a week due to coronavirus, and in December, Interpol and the FBI announced a coordinated seizure of domains utilised by the site. It appears that the servers were untouched, and the website was accessible via TOR mirrors (although some users suspect that the takedown was successful and that law enforcement now control the site – a tactic used with some darknet markets).

How many bitcoins does Joker have?

We can roughly calculate JokerStash’s retirement fund by factoring in the marketplace’s service fees. Deposit fees for cryptocurrencies are the primary revenue stream. All cryptocurrency payments made to the site are converted to US dollars at the current exchange rate minus a fee that has decreased from 8% in the site’s early days to 4% currently. The marketplace likely also receives a commission on the sale of partner-provided cards. Joker’s Stash’s commission is unknown, however it is often between 10% and 30% on other marketplaces.

Another crucial fact to keep in mind is that cyber security firm Gemini Advisory alleges that JokerStash stores all marketplace profits in bitcoin. If that’s the case, the recent surge in the price of bitcoin would have led to a significant increase in the market value of most other assets. Taking into account only bitcoin (the site also accepts Litecoin and Dash), they would have received a total of at least 60,000 bitcoins, which is currently worth $2.5 billion.

A vacuum that other carding markets can fill

Customers were upset because they were unable to access their accounts after February 3rd, even though Joker’s Stash said it will go down on February 15th. A victim of its own popularity rather than an apparent law enforcement operation, it is one of the rare illicit marketplaces to close on its own terms. There will be a rise in competition to fill this role in the cybercrime economy as a result of this.