U.S. Seizes 145 Domains and $43,000 in Cryptocurrency from BidenCash Dark Web Marketplace

The U.S. Department of Justice (DoJ) has announced a significant operation targeting BidenCash, a dark web marketplace notorious for trading stolen credit card data and personal information. The operation, which was court-approved, resulted in the seizure of 145 clearnet and dark web domains, as well as cryptocurrency funds used by the platform to process illegal payments. The seized domains now redirect users to a server controlled by authorities, displaying official insignias from the DoJ, FBI, Secret Service, and Dutch High Tech Crime Unit.

BidenCash, which operated from March 2022, was known for its open sale of compromised card records, login credentials, and personally identifiable information. Investigators estimate that during its lifespan, the platform enabled the trade of over 15 million compromised card records and generated at least $17 million in revenue. At its peak, the marketplace served over 117,000 users. To attract more criminals, the site released millions of stolen card details for free as a promotional tactic. Between October 2022 and February 2023, the BidenCash marketplace published 3.3 million individual stolen credit cards for free to promote the use of their services. The stolen data included credit card numbers, expiration dates, Card Verification Value (CVV) numbers, account holder names, addresses, email addresses, and phone numbers.

The authorities confirmed the seizure of cryptocurrency used by BidenCash but did not disclose the total amount or asset type. However, on-chain data suggests that the U.S. government seized roughly $43,000 worth of USDT, a stablecoin issued by Tether. This seizure highlights the government's increasing focus on disrupting illegal activities facilitated by cryptocurrencies.

Despite this enforcement success, security analysts have identified several active domains still tied to the BidenCash network. Cybersecurity expert Vmprotect, using domainhunter.pro, flagged at least seven still-active addresses. This underscores the resilience of such criminal operations and the technical challenges in achieving total disruption. In 2025 alone, law enforcement agencies have taken down hundreds of darknet-related domains and servers. Yet, threat actors continue to adapt, creating new channels to maintain their operations.

The operation against BidenCash is part of a broader effort by U.S. authorities to combat cybercrime and protect consumers from the illegal trade of personal and financial information. The seizure of domains and cryptocurrency funds sends a clear message to cybercriminals that their activities will not go unpunished. However, the persistence of active domains tied to BidenCash indicates that the fight against cybercrime is far from over. Law enforcement agencies must continue to adapt their strategies to stay ahead of evolving threats and ensure the safety of digital transactions.