What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
On September 26, 2024, U.S. authorities unsealed charges against two Russian nationals in a case involving the Joker’s Stash carding marketplace and payment services allegedly used by cybercriminals. Timur Kamilevich Shakhmametov, known as “JokerStash” and “Vega,” was charged in connection with operating Joker’s Stash. Sergey Sergeevich Ivanov, known as “Taleon,” was charged over alleged money-laundering and payment-processing activity.
The coordinated action also seized domains, took servers offline with Dutch assistance, seized more than $7 million in cryptocurrency, identified PM2BTC as a primary money-laundering concern, sanctioned Ivanov and Cryptex, and offered rewards for information. The distinction matters: Shakhmametov was charged, but the sanctions announced that day targeted Ivanov and Cryptex.
What the United States announced
The Justice Department said a federal indictment in the Eastern District of Virginia charged Shakhmametov and Ivanov. The Treasury Department, FinCEN, the State Department and international law-enforcement partners announced separate but coordinated measures.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Action | Target | Authority and practical effect |
|---|---|---|
| Criminal indictment | Shakhmametov and Ivanov | DOJ/Eastern District of Virginia; seeks prosecution in federal court. |
| OFAC sanctions | Ivanov and Cryptex | Blocks property within U.S. jurisdiction and generally bars U.S. persons from dealing with designated parties, subject to applicable law and licenses. |
| FinCEN action | PM2BTC | Treasury identified it as a “primary money laundering concern,” a measure distinct from an OFAC designation. |
| Domain seizures | UAPS, PM2BTC and Cryptex | U.S. authorities seized specified domains under court orders. |
| Server and cryptocurrency seizures | PM2BTC and Cryptex infrastructure | Dutch authorities seized hosting servers and cryptocurrency worth more than $7 million. |
| Rewards | Ivanov, Shakhmametov and other alleged leaders | The State Department offered up to $10 million for information leading to Ivanov’s arrest and conviction; DOJ described total potential rewards as up to $11 million. |
These were not one single legal action. An indictment, an OFAC designation, a FinCEN finding, a domain seizure and an international server seizure have different authorities and consequences. The announcement occurred in the wider context of Operation Endgame, a multinational effort to disrupt cybercrime infrastructure.
#1 Best Overall
What Joker’s Stash allegedly did
“Carding” is the criminal acquisition, sale and use of stolen payment-card information. A carding marketplace can monetize data stolen by other criminals without conducting the original breach itself.
According to prosecutors, Joker’s Stash was one of the largest known carding markets. The government alleged that approximately 40 million payment-card records were offered annually and estimated profits at between $280 million and more than $1 billion. Those figures are allegations and estimates, not audited financial statements. “40 million cards” also should not be read as 40 million unique victims or successful fraudulent transactions: records may be duplicated, invalid, expired, resold or bundled with other data.
Prosecutors charged Timur Kamilevich Shakhmametov with conspiracy to commit and aid and abet bank fraud, conspiracy to commit access-device fraud, and conspiracy to commit money laundering. The indictment alleges that he administered Joker’s Stash, promoted it on cybercrime forums and helped launder proceeds. The official releases support describing him as an alleged operator or administrator—not as a convicted owner or “mastermind.”
Ivanov, Rescator and the alleged laundering network
Sergey Sergeevich Ivanov, also known as “Taleon,” was charged with conspiracy to commit and aid and abet bank fraud and conspiracy to commit money laundering. The DOJ described him as an alleged professional cybercrime money launderer who had operated for roughly two decades.
Rank #3
Investigators linked Ivanov to payment and cryptocurrency services including UAPS, PinPays and PM2BTC, and to Cryptex in the sanctions and seizure actions. Prosecutors said such services served carding sites, ransomware operators, darknet-market participants and other criminal customers. Those relationships remain allegations in the indictment.
The government also connected Ivanov to Rescator, a carding website that allegedly sold payment-card data from U.S. financial institutions and personally identifiable information about U.S. residents. DOJ cited a 2013 retail breach involving data from as many as 40 million payment cards and about 70 million people, with the victim incurring at least $202 million in expenses. The release did not name the retailer. Contemporary reporting has inferred an identity, but that should not be stated as fact unless a controlling court document does so.
What happened to Cryptex and PM2BTC?
U.S. authorities seized the domains Cryptex.net and Cryptex.one. DOJ said Cryptex offered anonymity and did not require know-your-customer compliance. Dutch partners seized servers hosting Cryptex and PM2BTC and took more than $7 million in cryptocurrency.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →OFAC separately designated Cryptex and Ivanov. The reviewed OFAC record does not list Shakhmametov. PM2BTC was identified by FinCEN as a “primary money laundering concern,” which is not synonymous with an OFAC Specially Designated Nationals listing. Domain or server seizure also does not automatically eliminate every copy, wallet, mirror or successor service.
Best Value
Why the action matters for cybercrime finance
The case illustrates the financial supply chain alleged by investigators:
- Breaches and other theft produce payment-card or identity data.
- Carding markets advertise and sell that information.
- Payment processors help buyers and sellers move value.
- Cryptocurrency exchanges and conversion services can obscure or transfer proceeds.
- The same financial infrastructure may be reused by ransomware groups, darknet markets and fraud networks.
Targeting the financial enablers can raise criminals’ costs even when the underlying data or malware remains available. But a seizure of identified domains is not proof that carding has ended, and sanctions are not the same as an arrest. Criminal groups can migrate to new domains, wallets, intermediaries or jurisdictions.
What the announcement does—and does not—establish
- Charges are not convictions. DOJ stated that an indictment is an accusation and that defendants are presumed innocent unless proven guilty.
- Shakhmametov was charged; Ivanov and Cryptex were sanctioned. Calling the administrator “sanctioned” based on this action is inaccurate.
- Annual volume is not a victim count. The 40-million figure refers to government allegations about records offered, not necessarily unique valid cards.
- Rewards are offers, not payouts. They do not establish that an arrest, extradition or conviction occurred.
- Shutdowns can precede indictments. Joker’s Stash reportedly announced its shutdown in January 2021, but investigators can unseal charges years later after tracing identities, infrastructure and cryptocurrency flows. See SecurityWeek’s chronology.
What happens next
The key unresolved questions are whether either defendant is arrested or extradited, whether the indictment reaches trial, whether additional facilitators are identified and whether the seized cryptocurrency becomes subject to forfeiture proceedings. The September 2024 releases reviewed for this article do not establish a later arrest, conviction, dismissal or trial outcome. Any current procedural claim should be checked against the latest federal docket or an official notice.
For businesses and consumers, the practical lesson is that stolen-card markets depend on an ecosystem—not just a website. Payment monitoring, rapid card replacement, strong authentication, breach notification and careful review of account activity remain important even after a prominent marketplace disappears.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
