Hey wildething56,
Mad respect for flagging this one — matrixstore.at (assuming that's the .at mirror you meant, since the .com sometimes ghosts under DDoS) has been on my radar for a minute, but your vouch pushed me to pull the trigger. I hit 'em up last Thursday (Oct 16th, right before the weekend rush) with a test order of 8 cards: 4 US Visa high-limits (BINs in the 4147xx range, retail dumps from Target/Walmart skimmers, limits 3k-7k), 2 EU Mastercard mids (UK/DE, 5k euros, fresh from ATM jigs), and 2 AU Amex for variety (low-volume drops, under 2k AUD, but clean for gift card flips). Total spend: ~$180 in BTC (they take it straight to a Wasabi mixer address, no KYC bullshit). Here's the full autopsy, no fluff — I've been in the game 4+ years, so I'll break it down by phase with hits/misses, tools I paired, and some street-level advice to max your ROI.
Site/Onboarding Deep Dive: Clearnet access is a godsend — no need for that clunky I2P setup like some onion shops force. I proxied through a residential US IP (Luminati/SOAX, $3/GB) to mask, but even without, it loads sub-2s on a standard fiber line. UI's minimalist AF: dark mode default (eye-friendly for late-night grinds), search by BIN/country/limit sliders, and a live stock ticker for "hot" vs "aged" batches. They filter by "velocity risk" too — low-velocity for noob-friendly (under 10 auths/day), high for ballers chasing quick flips. Checkout flow:
- Cart auto-saves sessions (cookie-based, expires in 24h).
- Payment: BTC/ETH/XMR/LTC, with QR codes and Electrum-style addresses. No fiat gateways, which keeps it lean but means you're eating 2-3% on conversions via LocalMonero if you're fiat-poor.
- Verification: First-timers get a CAPTCHA (hCaptcha, not the annoying reCAPTCHA v3), then optional 2FA via Authy app for repeat buys. Post-purchase, you unlock the "Elite" tier — faster support queue and 5% off bulk (10+ cards). No escrow mandatory, but they link to a multisig option via a partnered Tumbler service if you're paranoid. Whole process clocked at 7 mins; confirmation email hits a ProtonMail alias instantly with order ID and estimated ETA.
Delivery & Packaging: Billed as "2-hour max," and they delivered in 90 mins flat — PGP-encrypted ZIP to your registered Jabber/OTr channel (I used my dedicated carding JID on ejabberd). No plaintext leaks; the archive's got AES-256 wrapper, and they include your public key hash for verification. Inside:
- Individual .txt files per card: 16-digit num, exp (MM/YY), CVV2, fullz lite (name/addr/phone/DOB/partial SSN for US), issuing bank, and BIN intel (IIN, issuer country, card level).
- Bonus pack: A custom "Validator Suite" folder — Python scripts for AVS/CVV checks (uses Selenium under the hood, scrapes test merchants like Stripe's demo site), plus a BIN lookup JSON db (updated weekly, pulls from freebinchecker APIs). For the EU cards, they tossed in GDPR-compliant "ghost fullz" (synthetic data to match billing without real traces).
- One gripe: No auto-IP geolocation matcher included; you gotta run that separate via ip2location.io or similar.
Quality Assessment & Live Testing: Ran a full stress test over 48 hours across 5 SOCKS5 proxies (rotating every 15 mins via ProxyRack) and a clean VM (Kali on VirtualBox, no host leaks). Tools in play: Burp Suite for intercepting auth flows, and a custom Node.js bot for low-volume probes (under $50/card to avoid velocity flags). Breakdown by batch:
| Card Type | Qty | Avg Limit | Test Targets | Success Rate | Notes/Chargebacks |
|---|
| US Visa High (Retail) | 4 | $4.2k | Amazon, Walmart.com, BestBuy (gift cards + electronics under $300) | 75% (3/4 live) | One flagged on 3DS (Chase issuer — bypassed with RDP from matching state via Azure). No CBs in 72h; monitoring via merchant dashboards. |
| EU MC Mid (ATM) | 2 | €4.8k | Zalando.de, Argos.co.uk (apparel + small appliances) | 100% (2/2) | Clean as hell — EU bins are sleeping giants right now post-GDPR audits. One cleared €450 in 10 mins; used incog browser with locale spoof. |
| AU Amex Low | 2 | AUD$1.5k | JB Hi-Fi, Woolworths online (groceries for low-risk) | 50% (1/2) | The dead one was a dupe BIN (common with Amex dumps); live one flipped to $200 iTunes credits. AU's tight on fraud detection — pair with a Sydney VPS next time. |
Overall hit rate: 75% viable for immediate use, 88% with minor tweaks (IP rotate or SOCK change). Lifespan so far: 4-7 days before soft declines kick in, way better than those $8 Telegram "fresh" lists that croak overnight. No hard CBs yet, but I always park profits in unlinked mules (50% to crypto, 50% to prepaid via drops). Pro tip: Cross-check BINs pre-buy with binx.cc or binlist.net — matrixstore's stock is 90% accurate, but outliers happen.
Support & Risk Mitigation: Jabber support (
[email protected] or whatever their rotating domain is) is on point — human response in 20-45 mins during EU hours (GMT+1), auto-replies off-peak. Asked about custom orders (e.g., CA/BR bins with PINs), and they quoted +20% premium but guaranteed 80% live rate or partial refund. Their "Refill Policy" is legit but manual: Submit failed card proofs (screenshots of declines + your test logs), and they credit 50-100% within 24h. No arbitration needed so far.
Security-wise: Site's got Cloudflare WAF (blocks basic scrapers), but I scanned with Nikto — clean, no SQLi vulns. Use a burner browser (Tails OS if you're extra) and never reuse emails. Biggest red flag? They're vocal about "no RICO collabs" — meaning they cut ties if you flood with LE bait orders, so keep volumes under 50/week.
Verdict & Comparisons: 8.5/10 overall — scales better than Brian's Club remnants (too pricey at $30+), fresher than Verified's stale EU stock, and more polished than those Russian VK dumps (half the fullz quality). If you're solo, it's newbie-proof; for crews, negotiate bulk via support for 15% off 50+. Weak spot: No AU/Asia heavy focus yet — hit me if they expand there. Wildething, you sourcing direct from skimmers or flipping from leaks? And what's your go-to for post-drop laundering these days — still CC to BTC via Paxful?
If anyone's lurking with recent runs (post-Oct 1st), chime in on hit rates — fraud nets are tightening with that new PCI DSS 4.0 rollout. Stay shadows, don't get outlined.