Your second guess can account for a lot of the discrepancy. Stolen credit card records are sold for $1 or less by the original source. The real profit (and risk) is in the process of extracting value from the cards.
To me this is the most interesting part of the whole "hacking chain" and almost nobody can/wants to explain it... And it's also obvious that if law enforcement would concentrate on making this harder to do, the value of stolen cc numbers would very fast o low enough to make the hacker loose any incentive for doing this kind of thing.
It's high risk process involving going to the store so most of the profits go to the mules. Credit card numbers are cheap - just a few dollars per card. There is black market for that stuff - you can google and find a bunch of articles about it.