"While this marketplace was the largest in the carding space, it also exhibited a severe decline in the volume of compromised card not present and card present records posted over the past six months," the Gemini researchers report. "Most other top-tier carding marketplaces actually increased their posted data (largely CNP data, while CP data declined during COVID-19 lockdowns) during this time."

(Source: Gemini Advisors )

After the expected closure of Joker's Stash, the market for stolen payment card data will quickly move to other darknet marketplaces such as briansclub, says Christopher J.S. Thomas, an intelligence product analyst with Gemini.

"It is very likely that the cybercriminals who buy and sell stolen payment cards on Joker's Stash will find new marketplaces," Thomas says. "The underground payment card economy is subject to the same basic market forces as other industries, and with cybercriminal vendors still generating a supply of stolen cards and buyers still generating demand for them, new or existing marketplaces will very likely facilitate their exchanges for a profit."

Joker's Stash

Joker's Stash is one of the oldest underground marketplaces for stolen card data, having been established in 2014. And while the Gemini report notes that its activity has declined since mid-2020, the site still published 40 million records over the past year, according to the report.

Over the past six years, Gemini calculates that the Joker's Stash site has generated some $1 billion in revenue.