Which cryptocurrencies are most used to buy stolen credit card data on the dark web in 2025?
Executive summary
Crypto is the primary cash rail for carding markets: historic analysis shows major carding sites processed hundreds of millions in crypto and vendors explicitly demand cryptocurrency payments [1]. Reporting in 2025 documents huge volumes of stolen cards (millions to tens of millions) traded or given away on dark‑web forums and markets that use cryptocurrency and escrow services [2] [3] [4].
1. Cryptocurrency is the default payment method on carding markets
Buyers and sellers on carding and stolen‑data marketplaces overwhelmingly transact in cryptocurrency. Dark‑web marketplaces use escrow and crypto to move value with plausible deniability and speed; market closures and retirements are tracked in crypto terms because the ledgers reveal the proceeds [5] [1]. Elliptic’s analysis of UniCC — named the “largest dark‑web vendor of stolen credit cards” — shows $358 million in purchases made in Bitcoin, Litecoin, Ether and Dash across its lifetime, demonstrating that multiple coins are used in practice [1].
2. Bitcoin, Litecoin, Ether and Dash are specifically named in reporting
At least one industry analysis of a top carding market (UniCC) lists Bitcoin, Litecoin, Ether and Dash as the currencies buyers used to pay for stolen cards, and Elliptic used blockchain tracing against those assets when estimating total proceeds [1]. This is direct evidence that those particular cryptocurrencies were prominent for card sales on major markets up through that market’s retirement event [1].
3. The market structure drives coin choice — liquidity, privacy, and tooling
Carding marketplaces favor coins that balance liquidity, exchange access and some privacy features. Reported market behavior and law‑enforcement tracing show vendors accept widely traded coins (Bitcoin, Ether, Litecoin) because they’re easily converted and traceable in ways that permit analytics firms to measure proceeds; at the same time, markets historically accepted privacy‑oriented or less traceable options to frustrate tracing [1] [5]. Available sources do not give a comprehensive ranked list of “most used coins” across all 2025 markets, but case studies show a multi‑coin approach [1].
4. Scale of the problem explains why many coins get used
Coverage documents enormous supply: reports cite 14–14.5 million stolen credit cards and multi‑million dumps or giveaways [2] [3] [4]. Kaspersky’s analysis of infostealer logs estimates 2.3 million bank cards leaked to the dark web from malware infections alone, and reporting of major market dumps (e.g., B1ack’s Stash releasing millions of cards) indicates a continuous flow of inventory that needs multiple payment rails and laundering strategies [6] [3] [4].
5. Law enforcement and blockchain analysis shape what we can observe
Elliptic and other blockchain investigators publicly attribute dollar figures to markets by tracing Bitcoin, Ether, Litecoin and Dash flows; those traces are why reporting highlights these coins [1]. That visibility is a double‑edged sword: investigators can follow widely used coins, which forces some criminal actors to adopt other assets or mixing services — but available sources do not enumerate those alternate coins or illicit mixers in 2025 in detail [1]. Available sources do not mention a comprehensive, audited ranking of coins by transaction volume for stolen‑card purchases across all markets in 2025.
6. Alternative viewpoints and reporting gaps
Some reporting focuses on ecosystem mechanics (infostealers, marketplaces, tutorials) rather than producing currency‑use tallies; F‑Secure and other analysts describe that criminals combine stolen cards, crypto and laundering but stop short of a market‑wide coin ranking [7]. Deep‑dive marketplace trackers list top markets and their histories [5], but they do not publish a single, aggregated dataset of crypto usage across vendors. Therefore, while evidence shows Bitcoin, Litecoin, Ether and Dash were major rails for at least one leading marketplace [1], there is no single source among the provided reporting that quantifies market‑wide usage percentages for 2025.
7. What this means for investigators and defenders
Because major carding markets process large sums in several mainstream cryptocurrencies, blockchain analytics firms and law enforcement target those rails [1]. The volume of leaked and sold cards (millions) increases the likelihood that multiple currencies and cash‑out strategies are in play as criminals seek liquidity and ways to evade tracing [2] [3] [6]. Defenders should therefore expect multi‑coin flows and tailor detection to both on‑chain analytics and off‑chain cash‑out methods; available sources do not provide technical detection recipes, only ecosystem descriptions [7] [1].
Limitations: reporting in the provided sources gives direct evidence that Bitcoin, Litecoin, Ether and Dash were used on major markets [1], and documents the large scale of card dumps and leaks [2] [3] [4] [6], but none of these sources publishes a definitive, market‑wide ranking of cryptocurrencies by volume for stolen‑card purchases in 2025. Available sources do not mention that ranked dataset.