WT1SHOP Marketplace Shut Down for Selling Stolen Bank Cards, Credentials, and Documents
Law enforcement agencies have completed an international operation resulting in the seizure of the website and domains of the underground marketplace WT1SHOP. This platform was known for selling stolen bank cards, documents, and millions of account credentials.
WT1SHOP was one of the largest markets for trading login and personal data. Criminals frequently sourced usernames and passwords for account takeovers, bank cards for unauthorized purchases, and identity documents used in various schemes, including full identity theft. The marketplace was typically advertised on Russian-language hacker forums and subreddits dedicated to fraud and cybercrime.
“WT1SHOP primarily served carders and fraudsters involved in account takeovers and offered its services to many criminal communities,” said Vitali Kremez, head of AdvIntel.
International Seizure and Domain Confiscation
According to the U.S. Department of Justice, Portuguese authorities seized the WT1SHOP website, while U.S. law enforcement confiscated four of the marketplace’s domains: wt1shop.net, wt1store.cc, wt1store.com, and wt1store.net. Other domains used by WT1SHOP (wt1store.biz, wt1store.me, wt1store.xyz, and wt1store.org) appear unaffected, but since the site is now under government control, visiting any of these addresses no longer provides access to the marketplace.
Millions of Users and Stolen Data
The Maryland District Attorney’s Office and the FBI report that the site traded in the personal information of millions of users, including stolen credentials, bank account information, bank cards, and scans of identity documents such as passports and driver’s licenses.
“A law enforcement review of WT1SHOP in December 2021 showed the site had 106,273 users and 94 sellers. Around 5.85 million credentials were available for sale,” authorities stated.
Dutch police estimated that as of June 2020, sales through WT1SHOP totaled $4 million in Bitcoin.
Administrator Identified and Charged
The U.S. Department of Justice stated that Bitcoin payments, email addresses, and administrator accounts for WT1SHOP were traced to 36-year-old Moldovan citizen Nicolae Kolesnikov. Authorities believe Kolesnikov was the administrator of the now-defunct marketplace and have charged him in absentia with conspiracy and trafficking in unauthorized access devices. If arrested and convicted, he faces up to 10 years in prison.