The Card Shop Ecosystem: Autoshops, Pricing, and Why Seizures Never Stick
Onion forums rarely mourn for long. Within weeks of the June 2025 takedown of BidenCash, the largest stolen-card bazaar of its generation, buyers were already asking where the next storefront would open. The answer is nearly always the same: somewhere new, running an old playbook.
Autoshops are not classic markets
A card shop is not a darknet market in the everyday sense. General-purpose markets sell drugs, forged papers, and hacking tools side by side; card shops are single-purpose storefronts dealing in exactly two goods. The first is dumps, the magnetic-stripe data used to clone plastic. The second is card-not-present credentials: card number, expiry date, CVV, and often the cardholder's billing address. The defining feature is automation. Analysts at Group-IB describe these platforms as automated vending carts that index millions of records by country, bank, brand, and expiration date, delivering purchases instantly without vendor contact. Haggling disappears behind a checkout form. It is e-commerce, complete with feedback scores and refund policies.What a stolen card actually costs
Pricing is granular yet remarkably stable. Industry price indexes put a standard US card with CVV at roughly $10 to $40, while a card with a verified $5,000 limit fetches around $110 to $120. Packages with full identity data attached, so-called fullz, range from $20 to $100 depending on completeness. Freshness sets everything above the floor. Shops publish validity rates refreshed daily, guarantee replacements for dead cards, and charge premiums for non-VBV stock that sidesteps common 3-D Secure checks. A working identity sometimes costs less than lunch.The leak-as-marketing era
In August 2021, a little-known shop called All World Cards published one million stolen cards free on underground forums, buying overnight credibility. Researchers at Outpost24 found most records dated to 2018 and 2019, likely collected by phishing kits and Magecart-style web skimmers, with only a few percent still valid. The stunt worked regardless, and the shop soon listed millions more. BidenCash industrialized the tactic after launching in March 2022 to fill the void left by Joker's Stash and UniCC. As BleepingComputer documented, it repeatedly gave away databases containing millions of cards, each release timed for maximum publicity."This process is known as carding, and it has become a key part of the cybercriminal's playbook," researchers at Elliptic wrote while tracing Joker's Stash, whose founder retired with an estimated $1 billion in bitcoin.
BidenCash and the seizure treadmill
The machine finally stalled in June 2025, when US and Dutch authorities seized about 145 domains along with associated cryptocurrency funds. According to the Justice Department, the market counted more than 117,000 customers and trafficked over 15 million payment card numbers. Its per-transaction fees generated at least $17 million in revenue. Our coverage of the BidenCash seizure follows the operation in detail. What came after was predictable: successor listings surfaced within days, recycling familiar branding and previously leaked inventory.Why carding shops keep coming back
Why does the game restart every time? Because the supply chain never dies with the domain.- Sources persist: phishing, infostealers, and web skimmers harvest fresh cards continuously, independent of any storefront.
- Funds survive: only some cryptocurrency is ever frozen, and operators bankroll relaunches from reserves.
- Demand is durable: fraudsters need inventory, and seller reputations migrate to whichever shop inherits the stock.
- Tor lowers the cost of failure: a replacement onion address takes minutes to deploy.