Which darknet markets dominated credit card data listings in 2024 and 2025?

1. Card shops vs. general markets — two different ecosystems

Darknet credit‑card trade runs on specialist carding shops (dumps, CVV shops, “card shops”) and on broader marketplaces that host dumps among other illicit goods. Sources describe BidenCash and card‑dump-focused sites as using regular “dumping” tactics — large periodic releases of cards — while markets such as Abacus, Torzon and Russian Market list credit‑card data alongside drugs, fake IDs and hacking tools ^{[1] [6] [5] [4]}. That division matters because card shops specialize in bulk CVV/dump listings and verification services; general markets provide broader reach and vendor migration when one platform falls ^{[1] [6]}.

2. Names that recur in 2024–2025 reporting

Security vendors and reporting name a relatively consistent set of players. Carding or data‑store brands cited across the sources include BidenCash (known for repeated dumps), Brian’s Club / BriansClub (long‑running card dumps), Joker’s Stash (historically dominant in cards), B1ack’s Stash (emerged 2024, claimed a 4 million‑card release in Feb 2025) and UniCC in vendor lists; markets that absorbed card listings or hosted stealer logs include Abacus, Exodus (successor to Genesis Market), Torzon and Russian Market ^{[1] [2] [3] [4] [6] [7]}.

3. Market tactics and evidence of dominance

“Dominance” looks different by metric: volume of dumps, frequency of new listings, or market share among English‑language buyers. Abacus is reported to have become a major English‑language market in 2024 with tens of thousands of listings and large revenues after other markets closed, while B1ack’s Stash used a mass free‑dump promotion to attract carders in Feb 2025 — a growth tactic that signals operational prominence in the carding niche ^{[8] [9] [2]}. Sources also note stealer logs and malware‑harvested browser/card data (Exodus/Genesis lineage) as a significant supply channel for card listings ^{[4] [6]}.

4. Pricing and scale put the problem in perspective

Multiple analyst reports and vendor blogs show stolen card prices remained low in 2024–2025 — often in the low‑dollar to tens‑of‑dollars range per card — which sustains high volumes and widespread listings. NordVPN and other aggregators placed average U.S. card prices in the single digits to low‑tens while dump datasets counted millions of records; DarkOwl and SOC‑style trackers documented multi‑million dumps being distributed or advertised ^{[10] [11] [2] [12]}.

5. Law enforcement, takedowns and vendor migration

Takedowns and law enforcement pressure reshuffled market share through 2024–2025. When large platforms are disrupted, vendors and buyers migrate to new or specialist shops; analysts recorded that Abacus and other 2021–2022 entrants absorbed users after earlier giants fell, and that successor services (Exodus as a successor to Genesis Market) reoriented supply toward logs and device‑harvested cards ^{[8] [4]}. Sources show the landscape is fluid: “dominant” in one quarter can be displaced the next ^{[8] [4]}.

6. Conflicting signals and reporting limitations

Sources do not supply a single authoritative ranking by card‑volume across 2024–2025; instead, industry trackers, vendor‑oriented lists, and security blogs emphasize different names depending on focus (card dumps vs. general market listings vs. stealer logs). For example, some sources foreground Abacus’s 2024 market dominance for overall listings while others spotlight card‑specialist shops like BidenCash, Brian’s Club and B1ack’s Stash for payment‑card commerce and bulk dumps ^{[8] [1] [2]}. Available sources do not present an agreed, quantitative market‑share table for credit‑card listings in 2024–2025.

7. Reporting takeaway for defenders and readers

If you track carding activity, watch both specialist card shops (BidenCash, BriansClub/Brian’s Club, Joker’s Stash lineage, B1ack’s Stash) and the larger multi‑category markets that list dumps and stealer logs (Abacus, Exodus/Genesis lineage, Torzon, Russian Market). Sources above show those names repeatedly in 2024–2025 coverage and incident reporting; action‑able signals include sudden mass “dumps,” advertised free releases and migrations after takedowns ^{[1] [2] [8] [4]}.

Limitations: reporting is based on security‑vendor blogs, aggregator posts and market‑tracking writeups rather than a single centralized dataset, so terms like “dominated” reflect repeated citation and observed tactics rather than a single audited market share figure ^{[6] [4] [2]}.