Loading story…
US authorities charged Zahid Hasan, a Bangladeshi national, with operating a network of illegal online marketplaces that sold digital templates for fake US government-issued identity documents, including passports, social security cards, and Montana driver’s licenses. These marketplaces, such as TechTreek and EGiftCardStoreBD, enabled cybercriminals worldwide to purchase high-quality digital templates for as little as $9.37 to $14.05, which could then be used to create fraudulent accounts at banks, social media platforms, and cryptocurrency exchanges. Over four years, Hasan allegedly received more than $2.9 million in cryptocurrency from over 1,400 customers globally. The US Department of Justice also announced the seizure of several domains associated with these operations as part of the crackdown.
The investigation culminated in a nine-count federal indictment against Hasan, who faces charges including transfer of false identification documents, false use of a passport, and social security fraud. The FBI and its partners coordinated the seizure of multiple domains used in the scheme, highlighting the international scope of the operation and the growing threat posed by digital identity document templates in facilitating cybercrime. The case underscores the increasing use of online platforms and cryptocurrencies in the global trade of fraudulent identity materials, and the ongoing efforts by law enforcement to disrupt these networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Hackread reported that Hasan was arrested after allegedly accepting Bitcoin for fraudulent templates from a U.S.-based individual, a step that investigators used to help build the case. The arrest was described as part of the same international law enforcement operation that led to the indictment and domain seizures.
On or before December 20, 2025, Hasan was indicted in the District of Montana on multiple federal charges related to operating online marketplaces for fraudulent identity document templates. The charges include alleged ID, passport, and Social Security fraud offenses carrying potential prison terms and fines.
U.S. authorities, led by the FBI and working with Bangladeshi law enforcement, seized three domains associated with Hasan's alleged fake document marketplace operation, including sites identified in reporting as Techtreek.com, Egiftcardstorebd.com, and Idtempl.com. The takedown was part of an international investigation involving the FBI's Billings Division, Salt Lake City Cyber Task Force, International Operations Division, and Dhaka Metropolitan Police.
Over roughly four years, Hasan's alleged operation served more than 1,400 customers globally and generated over $2.9 million in revenue, primarily through sales of fake document templates paid for with virtual currencies such as Bitcoin. Authorities said the documents were used to facilitate identity theft and the creation of fraudulent accounts at banks, payment processors, social media platforms, and cryptocurrency services.
According to the indictment, Zahid Hasan's criminal activity began by at least 2021, when he allegedly started operating online marketplaces including TechTreek and EGiftCardStoreBD that sold digital templates for fraudulent identity documents. The sites offered templates for items such as U.S. passports, Social Security cards, and Montana driver's licenses to customers worldwide.
2 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new bipartisan House bill, the **Stop Identity Fraud and Identity Theft Act**, would put the US Treasury Department in a central coordinating role to reduce identity theft and identity-related fraud by strengthening digital identity infrastructure. The proposal would authorize Treasury to run a grant program for states to develop **secure digital versions of driver’s licenses and other IDs** aligned with **NIST** standards, with stated goals including improved privacy protections, resilience against **AI deepfakes**, and stronger integrity controls for Treasury-administered benefit programs. Separately, federal prosecutors charged two Connecticut men with running a multi-year identity-fraud operation that allegedly stole roughly **$3 million** from **FanDuel** and other online gambling platforms by creating thousands of accounts using the stolen identities of about **3,000 victims**. Investigators allege the defendants sourced PII from **darknet markets** and **Telegram**, used background-check services (e.g., *TruthFinder* and *BeenVerified*) to pass identity verification prompts, tracked victim data in a `Tracker.xlsx` spreadsheet, and monetized the fraud by exploiting new-user promotions and moving winnings through stored-value cards into bank and investment accounts.
Jun 29, 2026
US authorities reported multiple enforcement actions tied to **crypto-enabled crime**. In the Empire Market case, prosecutors said co-creators **Raheim Hamilton** and **Thomas Pavey** designed the dark web marketplace to help users evade law enforcement and launder proceeds; the market allegedly facilitated about **$430M** in transactions (drugs, stolen payment data, counterfeit currency) before disappearing in 2020 in what investigators described as an exit scam that stole an estimated **$30M** in bitcoin. Hamilton pleaded guilty to federal drug conspiracy charges and agreed to forfeit roughly **1,230 BTC** plus **24.4 ETH** and real estate; Pavey previously pleaded guilty and agreed to forfeit about **1,584 BTC** and other assets. Separately, reporting highlighted alleged misuse and laundering of digital assets in other contexts. On-chain investigator **ZachXBT** traced movements from wallets associated with **US-seized crypto** (held under U.S. Marshals Service custodianship) to wallets allegedly linked to **John Daghita**, the son of a federal contractor executive, with claims of roughly **$23M** in diverted cryptocurrency and another wallet holding about **$36M** in Ethereum; ZachXBT said he alerted the **U.S. Marshals Service**. In another DOJ case, **Jingliang Su** (a Chinese national) was sentenced to **46 months** for laundering proceeds from a cryptocurrency investment fraud that authorities said victimized **174** people for **$36.9M**, using social engineering via social media/dating platforms and counterfeit trading sites, with **$26.9M** restitution ordered and multiple US agencies involved in tracing funds and dismantling the network.
Jun 29, 2026
A Russian-operated darknet marketplace, run by the group Karma Fullz, is trafficking in the identities of former U.S. visa holders who have since left the country. These synthetic identities, which include Social Security numbers, clean credit histories, and tax records, are being sold on a Telegram-based platform that exploits gaps in U.S. tracking of departed visa holders. The marketplace offers three tiers of identity packages, with the most valuable being aged ex-patriot identities priced at over $1,000 due to their rich credit histories and higher fraud success rates. Fraudsters are using these identities to open new bank accounts, apply for credit cards, claim fraudulent tax refunds, and access public benefits, all while appearing as legitimate users within U.S. financial systems. Financial institutions often fail to detect these reactivated identities due to a lack of effective monitoring for such activity, according to experts at SentiLink. The operation highlights a significant vulnerability in U.S. fraud risk management and underscores the need for improved detection mechanisms for synthetic identity fraud.
Jun 29, 2026