The Impact of Western Sanctions on Carders and the Russian-Speaking Cybercrime Underground

[Good Carder]

Western sanctions imposed on Russia following the full-scale invasion of Ukraine in February 2022 had a significant impact on the Russian-speaking community of carders — cybercriminals specializing in the trading and cashing out of stolen credit card data. These measures included disconnecting Russian banks from SWIFT, blocking the international payment systems Visa and Mastercard for transactions abroad, and sanctioning specific cybercriminal services and individual actors. By January 2026, the sanctions had become a catalyst for both short-term difficulties and long-term adaptation: the carding market became more crypto-focused, decentralized, and resilient to external shocks.

Based on reports from Chainalysis (Crypto Crime Report 2026), Trend Micro (2025), Recorded Future, and other sources for 2022–2026, we examine key aspects of the impact.

Short-term negative consequences: increased complexity of cash withdrawals and payments​

The sanctions immediately hit carders' carding-to-cash operations.

• Disconnection from international systems : Russian Visa and Mastercard cards stopped working abroad, and foreign cards stopped working in Russia. This disrupted traditional channels: drop-cards (intermediaries for purchases) in Europe and the US became riskier and more expensive.
• Restrictions on SWIFT and bank transfers : International transfers of fraudulent proceeds have become more complicated. Many exchangers and laundering services have been blocked.
• Sanctions against infrastructure : In 2025, the US, UK, and Australia introduced joint sanctions against Russian services that facilitate cybercrime (such as bulletproof hosting and crypto exchanges).

In 2022–2023, Recorded Future analysts predicted and recorded an increase in card fraud due to economic pressure: unemployment and the crisis motivated new participants to enter the carding industry.

Adaptation: Transition to Cryptocurrency and Alternative Channels​

Carders quickly adapted, turning sanctions into a driver of innovation.

• Cryptocurrency boom : Chainalysis' 2026 report notes record growth in the use of crypto for sanctions evasion and laundering in the Russian-speaking segment. USDT (Tether), Bitcoin, and privacy coins have become the primary means of cashing out. Specialized exchanges and P2P platforms focused on evading sanctions have emerged.
• Asian and "friendly" channels : Carders have shifted their focus to China, India, Turkey, and the Middle East for drops and cashouts. Prepaid crypto cards and mail forwarding services have become popular.
• Domestic fraud and new markets : The "no targeting of Russian/CIS" rule has been violated, leading to an increase in attacks on Russian targets (due to the reduced risk of prosecution). Trend Micro (2025) has recorded an increase in fraud in Russian-speaking regions due to "reduced law enforcement risks."

The Russian-language underground has evolved: forums have added sections on crypto and sanctions evasion, and tools have become more automated (AI for risk analysis).

Long-term changes in the ecosystem​

Sanctions have contributed to fragmentation and professionalization.

• Growing volumes and sophistication: Economic difficulties have increased the supply of data dumps (data leaks have increased). Group-IB and Trend Micro have noted a general increase in high-tech crime, including carding.
• State control in Russia: The authorities introduced "controlled impunity" — arrests for attacks on Russian targets but tolerance for external fraud. This stabilized the Russian segment but increased the risks for domestic operations.
• Global risks: Chainalysis (2026) highlights that Russian evasion methods (including tokens like A7A5) affect the entire crypto market, increasing risks for merchants and banks.

Current status as of January 2026​

By early 2026, the impact of sanctions had stabilized: carding remains profitable, but with increased operating costs. Russian-speaking actors maintain their dominance (70–80% of the global dump market) thanks to their adaptation to crypto and AI tools. Trend Micro describes the underground as "ever-evolving," resilient to geopolitical shocks.

New sanctions (2025) against specific services continue the pressure but do not halt the ecosystem.

Conclusion​

Sanctions haven't destroyed Russian-language carding; rather, they've forced it to evolve: from traditional banking channels to a crypto-centric, decentralized model. This has increased global risks, including a rise in scams, laundering, and fraud. For banks and regulators, this means the need for increased monitoring of crypto transactions and international cooperation. In the long term, sanctions could spur further innovation in the underground, making it even more resilient.