A hacker and carder has pleaded guilty to trafficking in more than half a million stolen card numbers that resulted in $36 million in fraud losses.

Rogelio Hackett, Jr., 26, pleaded guilty Thursday in Virginia to one count of access device fraud and one count of aggravated identity theft.

The hacker was arrested in 2009 for selling stolen bank card numbers in online criminal forums and IRC chatrooms. When authorities searched his home at the time, they found more than 675,000 stolen credit card numbers on his computers and in e-mail accounts. According to court records (.pdf), more than $36 million in fraudulent transactions have been attributed to the stolen numbers found in Hackett’s possession. Authorities don’t say how many of these transactions were committed by him or by others.

Hackett, who hails from Lithonia, Georgia, admitted that he had been hacking computers since the late 1990s, an activity that morphed into hacking-for-profit by 2002 when he began stealing bank card data from SQL databases. In August 2007, for example, he breached the server at an unnamed online ticket seller and stole information on about 360,000 credit card accounts. He still had the data on his computer two years later when authorities searched his home.

Hackett became a valued seller on underground carding forums, charging between $20 and $25 per stolen card account. He raked in between $200 and $800 a month and by the time he was arrested was living solely on earnings obtained through illicit activity. He snagged more than $70,000 from selling stolen card data and at least an additional $80,000 from fraudulent Western Union money orders that co-conspirators charged to stolen card numbers and sent to him. The proceeds helped him buy a 2001 BMW X5 as well as a pair of Louis Vuitton shoes costing more than $450.

He was caught after selling 40 stolen card numbers to an undercover Secret Service agent for about $1,100.

He’s scheduled for sentencing July 22 and faces a maximum sentence of 10 years in prison and a $250,000 fine, or twice the gross gain or loss, on the access device charge, and an additional mandatory two years in prison and $250,000 fine on the identity theft charge. He has also consented to the government requesting a hefty restitution order from the court for the full $36 million in estimated losses.