From here the attacker can sell the code to someone else for cash, or redeem it directly.  While in the example here Cardbuyer targeted the Tianxiafu service, all of the services listed above are targets already pre-defined in its source code.