Hacked - The Stash

Episode Date: January 26, 2021

Jordan Bloemen & Scott Francis Winder discuss a very well timed retirement in the world of cybercrime. If you like the show and want to make sure we can keep making it, please subscribe and if you can visit https://www.patreon.com/hackedpodcast and show us some love. Also - Special Christmas deal! Every purchase of a 2-year plan will get you 4 additional months free. Go to http://nordvpn.com/HACKEDPODCAST and use our coupon HACKEDPODCAST at checkout. Learn more about your ad choices. Visit podcastchoices.com/adchoices

I need to call a Polish friend to figure out how to pronounce this name. Steinchik. Stanchik. Steinchik. Stanchik. Stanchik. Stanchik is the name of a famous Polish painting, of this famous Polish figure. But for the purposes of this story, I just need you to be able to picture it.

It's this big old dramatically lit oil painting. And in the center is this character, Stanchic. He was this famous court gesture during the Polish Renaissance, and in the painting, he's sitting all slouched in this big old chair. Legs kind of kicked out in front of him, fingers intertwined in his lap, shoulders slouched, and this expression of doubt and concern on his face. He's lonesome, even as he's wearing the classic jester outfit, the hat with the three prongs and the bells on the ends. He looks like the illustration of a joker from a pack of carts.

But instead of putting on a show for the royals celebrating down the corridor, you can kind of just make them out in the painting. Stenshik just looks exhausted. He looks done. I first saw this painting, and it's a pretty few. famous painting, accompanying a forum post on the internet titled Finale. In it, a user fittingly named Joker makes an announcement that... Joker stash is closing. The user, Joker, runs a online store called Joker Stash.

When we opened years ago, nobody knew us. And for about six years, Joker Stash has been kind of the beating heart of an online community of people buying and selling these vast repositories of financial information, stolen and pilfered in some of the highest profile data breaches of the last decade. Today we are one of the largest cards dumps marketplace. The story of its rise and its role in the cybercrime ecosystem, as well as its looming retirement, is our subject today. Unfortunately, or fortunately, nothing lasts forever.

The full name of the painting is Stenshik during a ball at the court of Queen Bona in the face of the loss of Smolensk. On the table in the painting is a crumpled up letter, and this taken with the name tells the story behind the painting. Poland had just lost Smolensk to Russia, and while the royals in the background of the painting are off celebrating some other victory, only... Steinschik... Sees and feels the gravity of what has occurred. Stanchic can see something that everybody else is missing. It's time for us to leave forever. This is the stash here on Hacked.

It's a cybercrime story, but it's also very much like a business story. It reads a little bit like a Bloomberg profile. Right. It's a profile of like a disrupty person trying to break into an industry. And just like getting fed up with it and leaving? A little bit. The classic, classic Wall. street investment banker who turns into like a executive director for a charity maybe just plagued by

some kind of it is interesting to think what joker will go on to do after this is done you've got to assume he's probably made a decent amount of money in the last you know whatever it is eight years so oh yeah so i'm assuming he's probably stable so i think stability is interesting but the amount of money the dude the person has made is like it's not even in question it it's a lot yeah and it think to understand how they disrupted this market you need to understand the market first joker's stash is or was i guess depending on when people are listening to this because i think it's set to shut down in like three weeks uh it's a carding market so we kind of got to start with what carding is sure yeah we could talk about carding so carding is like one of the oldest forms of theft online you know as

e-commerce developed and especially the porn industry as people started using their credit cards to pay for things online, you know, those credit card numbers got stored into databases and, you know, pretty much hackers for the longest time have figured out how to break in and steal information out of databases. So stealing credit card tables out of databases is, you know, could be considered a very lucrative thing to do. I think it's definitely a very lucrative. See, that's super interesting because you jumped to a digital point of sale. You jump to.

People have typed the credit card into a website. And the hacker is going in and they're finding the credit card digitally. Because there's a whole other side of this too. Totally. There's the physical point of sale. That's just as, you know, like carting goes back far enough to when, you know, everything wasn't as strongly networked as it is today. But now every enterprise management system is connected to the internet somehow.

So physical transactions inside of a local retailer, you know, probably going into a database that is still accessible on the internet. So, yeah, of course. That's just an evolution of the topic, I think. I think there's a couple terms that we should establish for people. Sure. So we're going to start with the product that's sitting in the middle of this whole business ecosystem. Our first term is dump.

And a dump refers to that string of data that gets pulled off of a credit card. You're talking about how it's sitting inside of a digital database. It's also the string of data that's pulled off the magnetic stripe on the back of the card. Each card is broken down into the basic information of a credit card. The number, the security card, the dates, the shipping address, and the pin. Everything you need to turn around and use that card to do a transaction. And if you take those individual dumps records and you encode it onto potentially the magnetic stripe of basically anything, anything the size of a credit card, that's when you can turn around and use it to purchase stolen merchandise or gift cards or really anything.

Yeah, forfeit cards or forfeit cards. What's the word I'm looking for there? we make a replica of something it's not forfeit oh not plagiarized not um counterfeit no yeah counterfeit cards counterfeit cards there you go there you go leave that in the pod make sure everybody know the uh yeah you could take the information re-encode them and turn them into counterfeit cards and then you can use those counterfeit cards as if they're real until they get canceled So if this was you, where would you start going for that information? We've talked about the two options, the physical point of the digital, like which one of those to you is more appealing?

Well, I think the, I think your intended to use is the big thing. Like producing counterfeit cards requires a lot of infrastructure, right? You need to be able to essentially print and stripe new credit cards, which is, you know, requires a bunch of things. If it was just me, you know, not having that physical infrastructure and the infrastructure to make counterfeit cards, you know, that seems to be. be more of an organized crime sort of vibe. You know, as the lone wolf hacker vibe, I think, you know, you'd probably still be using those credit card numbers digitally, so you wouldn't actually be making the counterfeit cards. So, you know, you're really just looking for that dump, the data dump from the database, the credit cards table, you know, the customers table,

all the relevant information you'd need to use those card numbers. You could probably pretty easily track down and find, you know, small e-commerce sites that are using, buggy software or have default passwords and stuff like that. And it'd be probably pretty easy to get in. But so it depends on what kind of scale I was looking at. Like I know Joker's stash was looking at a pretty massive scale. You know, they were targeting massive retailers where if it was just me as a lone Wolfer, I'd probably want to go for something smaller.

Start small, get my feet wet and then go from there. So in this instance, you being a lone wolf for, that brings us pretty nicely to the next term, which is a reseller. In this case, you as a lone wolf would be the reseller. And the term is kind of unintuitive. Most of these big card dump shops rely on a whole bunch of different suppliers of stolen cards. Resellers are the people going out stealing those cards and I guess reselling them to the marketplace. And there was a thing that I found interesting about this, which was it's one of the rare instances of actual digital scarcity.

The idea behind this community is that you do not sell a card twice. you don't sell a card to two different card dumps, and a card dump never sells the same card to two different people. Once it's sold, it's supposed to be removed. And at this kind of level the Joker Stash is operating at, if you're found to be double dipping, you're excommunicata to the community. That makes sense.

One counterfeit card floating around, it's going to draw a lot less attention than like a thousand counterfeit cards, you know, the same number. Like visas got quite comprehensive AI, you know, they're risk mitigating. department's, you know, probably second to almost none. You know, they're dealing with such a crazy amount of fraud and they've got such great detection algorithms that, you know, it's probably a lot easier to keep one card being used fraudulently under the radar than if that same number is being

used by like 50 people, right? So if I'm paying real money for these cards or for these numbers, if I'm a buyer in this market, you know, I'm not going to buy something that everybody else has. You know, it's probably by the time, it's like when you, somebody posts like a discount code that's got one use on Reddit, you know, it's used in four seconds. You know, that's kind of probably how these credit cards are. It's like, you know, if you get a dump file that's got 50 cards in it and 50,000 people go to use it, you know, pretty certain that you're not going to be the first one, the probability says. You brought up buyers, and that brings us perfectly to the last kind of link in this transaction. in the last two terms, first of which is carters. And carters are the people in here who are buying these cards and then making the purchases. They're the people in this whole thing who are trying to realize a profit using the cards, not by selling them.

And they might do it by buying gift cards to then go buy stuff. They might jump straight to the high ticket items. But when you hear about carters, they're the customers of this whole ecosystem. And below them are runners. We're the people that are actually assuming the risk and physically going out into the world with these cards. I found this interesting. There's a couple different ways you can do this. You can just go to a store and try and buy something.

You can convert it into gift cards and go buy something with those. Or there's a pretty common one where because the card issuer might figure out that something is wrong pretty quickly, a team of runners might go to a bunch of ATMs with multiple copies of the same card and at the exact same time withdraw as much money as humanly possible, knowing that the card will be locked down the second after that transaction, but it doesn't matter because they've already taken out a huge amount of money from the account. Yeah, sure. They're just mitigating their future risk by realizing a bigger profit immediately. That makes sense as in a financial sense.

For sure. The whole thing is people minimizing risk by foregoing a little bit of profit in the future. It's the entire thing. The resellers are doing it. The market's doing it. The carters are doing it. Pretty much everyone but the runner is doing it. The runners is the peon.

There were the buck stops. Literally. And until 2014, that's kind of just how this whole thing worked. Yeah. Resellers, selling to markets, selling to Carter's, using runners. Until 2014, Joker's stash sort of bursts onto this scene with this really interesting sales pitch. And one of their earliest forum posts on the site, the original user Joker explained where they got their dumps from. And he summarized it as follows.

This meme. In our shop you can buy only our own stuff, and our stuff you can buy only in our shop. Nowhere else. And they could do this because they were a combination reseller and card market. Unlike so many of the other carding sites that were mainly selling cards stolen by other hackers, Joker Stash claimed that all of their cards were exclusive self-hacked dumps. They were doing both the hacking and the selling. And that's how they could maintain this really steady drip of super high quality control.

dumps. And the quality was, as the community responded to it, like, pretty high. I think in business, they call that vertical integration. So he cut out one of the, one of the, one of the lower levels and started doing the hacking himself too, to ensure that the, to quality control what he was selling on his site. Interesting. It makes sense. Like I could see, I could see how at that point, like if you know that you're buying something direct from source, that nobody else is going to buy, and the person who runs the selling market is holding themselves responsible for the quality, I can see how you'd garner a higher price because you've got a much stronger assurance because in the reseller markets, you know, you don't know what the,

what the reseller is done with them. You know, you don't know what the hacker who hacked the dump. He might have already used them or tried them or been buying things online or whatever. He might have already compromised that dump. and especially if the dump information isn't like, you know, in Krebs or something, like if you've hacked into Target and Target doesn't know it yet, then Visa hasn't been notified that all those card numbers are potentially fraudulent, you know, where the second you start showing up on more public domain stuff, you know, reseller markets and stuff like that, Visa probably monitors those greatly.

I'm sure they monitored Joker's stash too, but maybe they have a harder time finding out where the information came from. And you'd think it was a gimmick if it wasn't for the fact that the hacks were high, right? Like if it was bad content, maybe this could be sort of a way of selling it. But by all accounts, the quality of the dumps was pretty up there. And so it was the profile of the targets they were going after. They were hacking Hilton hotels, Whole Foods, Chipotle, like relatively big brands. And so slowly they start to develop this reputation.

We've got good dumps, hacked themselves. They've got quality control. And as people flood in in response to that quality of the product, They started, I guess, applying that same quality to the nature of the store. It wasn't this sort of like digital lemonade stand they'd popped up. It was like, it really felt like a real business. It had loyalty rewards and bulk discounts and user reviews. They were approaching like a service and they wanted it to be a pretty good one.

Clearly, a smart businessman, whether his talents are his or her, I guess we'll never know. I keep saying him, but, you know, I shouldn't gender it because who knows. The talents that they have, you know, they clearly leverage them, you know, whether you ethically or morally agree with what they're doing. Clearly they were, they figured some stuff out. You know, there's a lot of businesses out there that don't have the level of sophistication and marketing and customer management that they do. So I wanted to do a little like due diligence to figure out if this was a business, if I would

personally invest in them. You want me to be a VC and you give me the elevator pitch? Oh man, I'm not sure if I'm ready for a shark tank, but I do. you got some fun trivia about how the store worked. Cool. Let's hear it. So like any big box store, the sort of same stores that they were hacking and buying stuff from, they had bulk discounts, including this built-in discount system for larger orders, 5% for customers if you spend over 300, 15%, over 1,000, and 30% off for customers who topped up their Bitcoin balance to the equivalent of $10,000 or more, which alludes to a very important point that's going to come up

later, which was that this whole store ran on Bitcoin. It's true of almost all these markets. Joker stash ran on Bitcoin. And you were incentivized by the store structure to keep a lot of coin in your balance because you could get a discount. They had loyalty bonuses. Customers with higher ratings could get advanced notice of new batches or stolen cards, as well as more time intolerance to get refunds of cards didn't work, which is to say they offered refunds of cards that didn't work. There were big customers, kind of high rollers that could qualify for a special tier full stash category.

And to get in, you had to have deposited more than $10,000. essentially you had to approve yourself to this community they were trying to build. And they had these big spender partner clients. And I thought just from a security perspective, this was kind of cool. If you reached this partner tier, they would issue you these custom domain names. You'd get three custom three word domains that when you logged in, you only went to the domains and they were displayed across the top of the site. And you were encouraged to only ever use those custom domains to access Joker's stash. why do you think they would do this?

Probably tracking, maybe. You know, obviously there's some perks there where if you get offered a custom domain name, you know, they can customize and tailor the content on it for you. You know, that's the marketing side of it. But the other side of it is, too, is that you'd be the only inbound traffic to that site. So there'd be a bit of a way to track people from it.

That's actually a very good point. As well as verification. So like if you know that, you know, customer X always comes from, you know, Papua New Guinea. And then one day he's coming from Turkey or one day he's coming from, you know, the center of the United States. Maybe it's, you know, maybe it's not him anymore or them anymore. So you'd have, you'd have some ability to put in some security checks using stuff like that.

That is interesting. There's one and a half other reasons. And the one I bumped into was that essentially if your main domain ever went down or you had to switch over to a new registrar, your really, really big customers wouldn't be affected because whatever got taken down probably had nothing to do with their special custom URLs. They've got kind of their own secret door in the alley to the shop. Sure. So when CIA takes down the main Joker's Stash page, then all of the big spenders still have access to it. Smart. And as Joker Stash became more and more prominent, people started. started taking note and they started noticing how much traffic was going to those main domains and they started getting ideas. And we're going to tell you about one of those schemes right after the break. Think about the last time you heard a breach story on this show. It always starts the same way.

Someone somewhere saw something too late. An alert buried, a signal missed, an SOC that just couldn't keep up. Arctic Wolf set out to solve that problem by rebuilding security operations from the ground up for a world where attackers are already using AI. They created the Aurora superintelligence platform, a fully agentic system powered by the swarm of experts. Instead of single-purpose bots or lucky-guess LLMs, this swarm is full of deterministic agents that handle whole entire workflows. Humans stay in the loop and on the loop to validate the critical decisions and keep everything trustworthy. And all of this is just off running on their secure operations graph. A constantly updating intelligence engine fueled by more than 9 trillion telemetry events every week and over a decade of real-world

incident response. The system reasons on real signals and real context, not synthetic training data. And the result is the new Aurora Agent SOC. It's the first SOC that is agent led by design. You get agents that coordinate, agents that investigate, agents that respond at machine speed, and hundreds more that automate the repetitive work that normally buries human analysts. Arctic Wolf didn't try and bolt AI onto an old model. They rebuilt the model entirely.

What makes even more effective is how it works with Arctic Wolf's concierge experience. The team brings customer-specific context directly into the platform so every AI-driven decision reflects your environment instead of generic assumptions. The automation frees your concierge security team to focus on higher value strategy and proactive risk reductions while the agents handle the grind. If you want to see what trustworthy, production-ready AI and security operations actually looks like go to arctic wolf.com slash hacked. Never feel like cyber threats are evolving faster than anyone can keep up?

Last year, 2025 was nothing short of a record-breaking year for major breaches, from sophisticated ransomware operators to AI-enabled attacks that turn defenses on their head. Organizations around the world saw headlines they never expected, and cybersecurity teams were tested like never before. But here's the thing. These incidents aren't just news headlines. They're learning opportunities. And that's why Arctic Wolf is hosting a live webinar on February 5th, diving to the most impactful breaches of 2025.

Their field CTO and security leaders are going to unpack not just what happened, but why these attacks succeeded. And most importantly, what businesses can do to fortify their defenses for it's too late. You're going to walk away with real insights into how threat actors are evolving, how defenders are responding, and what strategies can help you stay ahead of the next big breach. It's not fearmongering. It's practical, actionable, intelligence from experts in the trenches. Register now at arctic wolf.com slash hacked. It's back in 2018 and the security researcher logs into Joker's stash to take a look around

the shop. He logs in and he drops in his $100 Bitcoin security deposit at jokerstash.Sach.Su. And the site tells him that, you know, fraud has been up and to make sure that users are legit about spending in the store that they're here to do business, the minimum deposit has been increased to $200, $200 in Bitcoin. So this anonymous researcher deposits another $100. At this point, he is promptly logged out, and when he goes to log back in, his credentials do not work. Joker's stash does require a deposit, and there are discounts for larger investments.

But jokerstash.sdash.su is not the real Joker stash. It was a fishing scheme, available on the clear web to trap people clamoring around trying to find the real Joker stash. This explains a couple things, but most prominently. why you would want to do those custom domains because people just trying to find Joker Stash for the first time was a huge attack vector for people going after their credentials.

Researchers would later find out that the scheme was operated by this really ambitious Pakistani web firm called Experia Solutions. Operated by a guy named Mohamed, aka Masun Perinda, aka a dude who made a Photoshopped movie poster I'm looking at right now, posted on his Facebook,

featuring himself as like a good fella style crime lord. Nice, nice. He's got like a gun and he's like kissing a pretty lady in the background. And the tagline to his movie, maybe it's the name of the movie, is never trust crime. Wow. Which is good advice. You should never trust crime.

Yeah, I guess. Words to live by. But the grift, which didn't last very long, was kind of far from the only one of its kind. And it speaks to this dominance the Joker stash was finding in this ecosystem and culture over the year since 2014. They were the big dog now. Ambitious people were riding on their coattails. And really, they'd kind of earned it. Their stuff was good.

And having been around and survived since 2014, they were really the oldest major store currently in operation at the time. They'd sort of taken over. Unfortunately, or fortunately, nothing lasts forever. You can actually chart the decline in the volume of cards and content that Joker Stash is posting in 2020. Like there are actual charts that you can look at, a security firm called Gemini advisory made them,

and you can see the drop off and volume of card dumps on this illegal commerce site that they were tracking. And the community is noticing. They don't need charts. They see less content. They see lower success rates with the cards they're buying. And Joker Sesh finds itself in something of this like PR crisis. The admins are on the site posting that now you've got new content coming.

The valid rates are going to go up. It's going to get better. There's more stuff to come. But it's becoming clear to this community that something is wrong, that the brains behind the operation were. a little bit foggy. And in October 2020, Joker, the same one who kicked all of this off

with the original post in 2014, posts again explaining why. Tell me why. Tell me why. Fucking COVID. I got infected with COVID 14 days ago. I start to feel myself not so well. In two three days off to begin, I start to feel myself terrible.

They go to the doctor, they get diagnosed with COVID, they eat a bunch of pills, their words and conclude, quote, Sorry for this unplanned shift and pause in my work. We are all humans. Sometimes we are weak. I will back to normal work in one, two days,

and will continue to do regular daily fresh updates. Thanks for understanding. And it's impossible to know the cause and effect of what follows, but it feels kind of like the first domino falling. In December 16th, 2020, several of Joker's long-held domains begin displaying notices that the sites had been seized by the U.S. Department of Justice and Interpol. The shop bounced back quickly, hopping over to new infrastructure, promising the underground

community that it's going to continue to operate normally. But as Gemini continues to track in their many fine, fine charts, the quality is just falling and falling. Joker had gotten COVID, the authorities were gaining some kind of a foothold in their operation, their clients are losing faith. And so finally, on January 15th, Joker posts again. That original post we talked about in the intro. Finale. Joker goes on a well-deserved retirement. Joker's stash is closing.

When we opened years ago, nobody knew us. Today we are one of the largest cards dump marketplaces. Unfortunately, or fortunately, nothing lasts forever. It's time for us to leave forever. We will leave the stash open for 30 more days the 15th of February, so all stash users can spend accounts balances. On the 15th of February we will wipe all our servers and backups and Joker will fade to dark forever.

And mark my word, we will never ever open again. Do not trust possible future impostors. After the 15th of February there will be no more Joker and no more Joker's stash. Dear partners of stash, you can be sure that before we leave forever, you will get all payouts. Contact me, you know how. That's very distinguished. You know, he's drawn a line in the sand. He's shutting down shop and he's giving,

he didn't do like every Bitcoin exchange and stuff and to just take everybody's deposits and hit the road. So, you know, it seems like they're quite a substantial qualified business, you know. I guess his weakness is or their weakness was that it seems like it was mostly a single person. It does seem like it has a voice to it. Like there is this sense that there is someone piloting the ship. And it's a ship that steals and sells stolen credit card information. But it also seems like it's a single pilot ship.

Like it's like, you know, I get sick. You know, we don't make the podcast. Or, you know, if you can still make the podcast, you know, if you're the only person in your criminal enterprise. So you've got to imagine that, you know, over the years, dealing with such high quality content and buyers, probably socked away a lot of Bitcoin. And I feel like mid-January, something happened with Bitcoin.

Yeah, some were sad. Others who were disappointed with the declining quality and the site were kind of more neutral about it, figured it was time. Some accepted the premise of why Joker was shutting down. Other thought it was a conspiracy that FBI had detained Joker. But I think there's this other possibility. And that...

I think you might be ahead of me on this. Which is that when you look at this, not as a hacking story, but as a business story, it makes perfect sense. One year ago, Bitcoin, the currency that Joker's stash operated on, the currency held in user accounts as a measure of trust, the currency Joker had essentially been paid in, realizing the profits of this giant e-commerce platform of was worth about $11,000 a coin. That was a year ago, just one year. And today, it's worth, I think, $44,000 a coin. Yikes. That's a $400,000.000. That's a $400,000. jump in one year.

What was it worth in 2014? And Joker's stash was this early advocate of Bitcoin, and they claimed to have kept all the proceeds in it since 2014 when it was valued at the start of the year at about $450. Yeah, there you go. Sounds like a pretty good retirement story. Pretty good return on your startup. Joker is in all likelihood in the upper echelon of wealthiest cyber criminals, and the spike probably just multiplied it.

It almost certainly just multiplied it. And I think this is just a person looking at their loot and saying the time for holding is past. It is time to sell. Totally. And like the, with the CIA, FBI and anybody else knocking on your door, it's only a matter of time. It's got to be hard to sit there and be like, I got like $65 million in the bank. And maybe I'll just ride it out and see if I go to jail for the rest of my life. Or maybe I just disappear right now and, you know, the world will never know who I was.

It is estimated that since its creation, Joker Stash has generated over a billion dollars in revenue. What? They have sold hundreds of millions of stolen cards, but at the end of the day, it is, as you said, it's just a business. And those get bought and sold, new ones come along and shove them out,

which is going to happen here. The collapse of Silk Road had functionally no impact on the amount of illegal commerce on the dark web. Someone's going to replace them. But I think this is just a person with good timing. A billion dollars? In revenue. Let's just back up to that because if we're talking about a solo piloted ship, and essentially

is like a very low infrastructure cost. Like, you know, I don't even know how you could spend $100,000 a year operating unless he had tons of admins and moderators and stuff like that. But a billion dollars in revenue for essentially a product that costs nothing to acquire, no cost of goods sold. And a billion dollars in Bitcoin. Yikes. Yikes. That's wild.

Wild, wild. So there's this last line at the end of the finale post that is super interesting. And it's super interesting considering the length the Joker went to to make a buck. It's super interesting considering how they did it, like the theft of credit cards, this sort of symbol of commerce and capital. It's interesting to read it under this painting of that Polish jester stenchik, wearing, kind of sitting wearily in his chair, this look of realization on his face. And the last post concludes, we also want to wish all young and mature one cyber

gangsters not to lose themselves in the pursuit of easy money. Remember that even all the money in the world will never make you happy and that all the most truly valuable things in this life are free. Spooky computer voices. Thanks for listening, everybody. If you want to support the show, you can check us out at Patreon. dot com slash hacked podcast you can find us on twitter at hacked podcast it's first episode of 2021 happy to be back catch in the next one