Loading story…
Joker’s Stash, one of the largest dark web marketplaces for stolen payment card data, announced it would permanently close after allowing users roughly 30 days to withdraw balances and complete partner payouts. The operator said the market would remain online until February 15, 2021, then wipe servers and backups. The shutdown followed months of instability, including a reported decline in newly posted card records, customer complaints about poor card validity, and claims by the administrator that illness from COVID-19 had disrupted operations.
The closure also came after suspected law enforcement pressure, including reports that blockchain-linked domains briefly displayed FBI and INTERPOL seizure notices and allegations that proxy servers tied to the marketplace had been seized by the U.S. Department of Justice and INTERPOL. Researchers said the broader underground payment-card economy was unlikely to collapse, with displaced vendors and buyers expected to migrate to rival carding markets such as Brian’s Club, Vclub, Yale Lodge, and UniCC, which moved quickly to attract former Joker’s Stash users through promotions and other incentives.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Joker’s Stash said it would cease operations on February 15, 2021, ending the 30-day wind-down period announced in January. The operator also said the site’s servers and backups would be wiped after that date.
From February 3 to 9, 2021, UniCC reportedly added almost 300,000 new credit card details, reflecting efforts by rival marketplaces to absorb users displaced by Joker’s Stash’s closure.
On January 15, 2021, Joker’s Stash announced on its site and underground forums that it would close permanently and that the administrator was retiring. The operator said the marketplace would remain open for 30 days so users could spend balances and partners could be paid.
In December 2020, several Joker’s Stash blockchain domains were temporarily replaced with an FBI and Interpol seizure notice, prompting speculation about law enforcement pressure. The administrator later regained control of the affected domains.
In October 2020, the alleged Joker’s Stash operator said he had contracted COVID-19 and spent more than a week in the hospital, which reportedly disrupted forum activity, inventory replenishment, and other operations.
Gemini Advisory reported that Joker’s Stash had operated since 2014 and was one of the oldest observed dark web marketplaces in the payment card underground.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
intel471.com
Open sourceke-la.com
Open sourcegeminiadvisory.io
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dark web carding marketplace **B1ack’s Stash** released about **4.6 million stolen credit card records** for free after accusing some sellers of reselling data purchased on its platform through rival shops. The forum said it removed roughly **8 million `CVV2` records** from active inventory and moved 4.6 million into its freebies section, while allowing some trusted sellers to seek reinstatement through support channels. Reporting cited by SC Media and analysis from SOCRadar indicate the exposed dataset is largely authentic, with about **4.3 million records** assessed as fresh after excluding duplicates, expired cards, and previously known entries. The leaked records reportedly include full payment card data along with extensive personally identifiable information, including names, billing addresses, email addresses, phone numbers, and IP addresses. Researchers said the breadth of the data suggests collection through **e-skimming** or **phishing**, and warned of immediate risks including card-not-present fraud, identity theft, targeted phishing, and credential abuse. Most affected cards are tied to the **United States**, with significant exposure also reported in **Canada, the United Kingdom, France, and Malaysia**, underscoring the international scope of the breach and B1ack’s Stash’s continued use of free data dumps to build notoriety in the cybercrime market.
Jun 29, 2026
Jerry’s Store, a carding marketplace used to verify stolen payment cards, exposed roughly **345,000** credit card records after a misconfigured server left an unauthenticated web directory publicly accessible. Reporting indicates the operators used the AI-assisted coding tool **Cursor** to build a statistics dashboard, but the generated implementation exposed logs, development details, and sensitive cardholder data instead of restricting access. The leaked records included card numbers, expiration dates, `CVV` values, names, and addresses; about **145,000** cards were marked valid and nearly **200,000** invalid, with the valid inventory alone estimated to be worth **$1 million to $2.6 million** on dark-web markets. The exposed infrastructure also revealed how the marketplace tested stolen cards through small, low-risk transactions at legitimate merchants including **Amazon, Temu, Lyft, Grubhub, Sam’s Club, Elf Cosmetics, and CountryMax**. Researchers said Jerry’s Store launched in late 2023, primarily targeted victims in the US and EU, and may be run by a Chinese-speaking administrator using infrastructure hosted in Germany, possibly through a bulletproof hosting provider. The server was reportedly discovered on April 16, and the leak offered an unusual view into both the marketplace’s stolen-card inventory and its operational methods.
Jun 29, 2026
Dark-web monitoring reported new underground listings advertising an alleged **80 million** payment card dump, including claims of CVV/expiration data and download access, with indicators it may be an aggregated collection rather than a single fresh breach (often combining previously leaked data, stealer logs, and other illicit sources). The same monitoring roundup also mentioned separate, unverified listings claiming access or data tied to **Suno**, **ASUS**, and **Air France**, but the payment-card dump was presented as a distinct offering within that weekly set of listings. Separate threat research described the broader **carding-as-a-service (CaaS)** ecosystem in which “dump shops” and marketplaces package stolen card data (e.g., CVVs, magnetic-stripe “dumps,” and identity-rich “fullz”) alongside tooling and support, enabling fraud at scale. The research highlighted that despite takedowns, major marketplaces continue to operate and shape criminal demand, providing context for how large card-dump listings are monetized and why organizations should expect continued availability and reuse of stolen payment data across multiple criminal venues.
Jun 29, 2026