The Impact of Russia's War on Ukraine on the Global Carding Market

[Good Carder]

The Russian-speaking cybercriminal community has historically dominated global carding — the trade in stolen credit card data (dumps, CVV, and full accounts). According to analysts (Chainalysis, Group-IB, and Trend Micro), by 2022, up to 80–90% of high-quality dumps and cash-out services originated in Russia, Ukraine, and other former Soviet countries. Russia's full-scale invasion of Ukraine in February 2022 radically altered this ecosystem, triggering a split, adaptation to sanctions, and long-term shifts in the global market. By 2026, the war's impact remains significant: the market has become more fragmented, crypto-focused, and resilient to external shocks, but with diminished trust and the growth of regional niches.

Based on reports from cybersecurity companies (Trend Micro 2025, Group-IB Hi-Tech Crime Trends 2025, Chainalysis Crypto Crime Report 2026, Recorded Future and Global Initiative) for 2022–2026, we will consider key aspects of influence.

Community Splits and Market Fragmentation​

The war shattered the former unity of the Russian-speaking underground. Until 2022, carders from Russia and Ukraine collaborated closely: Ukrainian groups often extracted data, while Russian groups provided infrastructure and cash-out channels. The conflict led to deep divisions along ethnic and political lines.

• Pro-Ukrainian niches: Specialized platforms (for example, forums like DUMPS) have emerged, targeting the trading of Russian and Belarusian data, with bans for Russian users. This has increased the supply of Russian dumps on the global market.
• Pro-Russian platforms: The main forums (XSS, Exploit, and similar ones) retained their dominance, but with strict prohibitions on politics. Trust among participants declined, with increased use of escrow services and rigorous partner screening.

Globally, this has led to fragmentation: some actors have migrated to English-language or Asian platforms, and new niche markets have emerged. According to the Global Initiative (2025), the war has "reshaped major cybercrime markets" in Eastern Europe, making the ecosystem less monolithic and more decentralized.

Impact of sanctions on transactions and cashing out​

Western sanctions against Russia (disconnection from SWIFT, blocking of Visa/Mastercard, restrictions on international payments) have become one of the most powerful blows to carding.

• Cashing out is becoming more complex: Traditional channels (drops, money mules in Europe/USA) have become riskier. Carders have switched to cryptocurrency (USDT, Bitcoin), anonymous exchanges, and Asian/Middle Eastern services. Chainalysis notes an increase in the use of crypto for laundering in the Russian-speaking segment.
• Growing domestic fraud: The "don't target your own" rule has been violated — Ukrainian groups are actively targeting Russians, leading to a flood of Russian cards entering the market in 2022–2023. In response, Russian carders have increased their focus on the West and Asia.
• Adaptation: By 2026, the market has stabilized due to alternative methods (prepaid crypto cards, mail forwarding).

Recorded Future (2022–2025) predicted and confirmed the rise in card fraud due to sanctions: economic difficulties in Russia motivated new participants.

Changes in global carding and card fraud trends​

The war had an indirect impact on the entire global market:

1. Growing volumes: Sanctions and the economic crisis in Russia have increased the supply of dumps. Group-IB (2025) notes a general increase in high-tech crime, including card fraud.
2. Industrialization and AI: By 2026, carding will become more "industrialized" — automated scanners, AI for generating fake data, and real-time scams. Trend Micro highlights the evolution of the Russian-language underground.
3. Geographic shift: Some Ukrainian actors have emigrated to the EU, amplifying European fraud. Russian actors are focusing on "friendly" regions (Asia, Latin America).
4. Tightening controls in Russia: Authorities have introduced "controlled impunity" — arrests for attacks on Russian targets, but tolerance for external fraud. This has stabilized the Russian segment.

Global reports (EPC 2025, Visa/Mastercard trends 2026) record an increase in push payment fraud and scams, partly related to geopolitics.

Current status as of January 2026​

By early 2026, global carding had adapted: dump and CVV trading volumes remain high, but the market is more distributed and crypto-centric. The Russian-speaking segment maintains its leadership (around 70–80%), but faces competition from Asian (China, Indonesia) and Latin American groups. Trust has not fully recovered, slowing large transactions.

Chainalysis (2026) notes the growth of nation-state activity in crypto, including its use to evade sanctions. Trend Micro describes the Russian-speaking underground as "ever-evolving," resilient to war and sanctions.

Conclusion​

Russia's war against Ukraine marked a turning point for global carding: it accelerated the shift to crypto, fragmented the market, and increased the adaptability of criminals. Short-term losses (from sanctions and disunity) gave way to long-term stabilization, but with increased risks for victims worldwide. In 2026, the trend toward industrialization and AI will make carding even more effective, requiring banks and regulators to take new approaches to countering it.