How do hackers monetize lists of username/passwords?

I see hackers paste these huge hacked username/password databases on sites like pastebin etc.

I know this is highly illegal and would never risk doing something like this, but theoretically speaking, how can such database be monetized?

Do they fake CPA submissions somehow? Or sell the db (useless if its published...?)