Europol, FBI wipe major cybercrime forum LeakBase off the web

An international law enforcement operation involving the US Federal Bureau of Investigation, Europol and other agencies has taken down one of the internets most notorious cybercrime forums, LeakBase.

The forum was a place for hackers to buy and sell stolen data and cybercrime tools, amassing more than 142,000 members and over 215,000 messages.

“The FBI, Europol, and law enforcement agencies from around the world executed a takedown of LeakBase, one of the largest online cybercriminal platforms, seizing users accounts, posts, credit details, private messages, and IP logs for evidentiary purposes,” the FBI cyber division assistant director Brett Leatherman said in a statement on Wednesday.

LeakBase takedown involved 14 countries

The takedown operation, which ran on March 3 and 4, involved law enforcement agents and officers in 14 countries taking synchronized actions against LeakBase and its users.

Following the operation, authorities replaced the site with seizure banners, issued prevention notices to members, and collected additional evidence.

An alert now pops up on LeakBases website. Source: US Department of Justice

Law enforcement also executed search warrants and arrests in the United States, Australia, Belgium, Poland, Portugal, Romania, Spain and the United Kingdom.

“The takedown of this cyber forum disrupts a major international platform that cybercriminals use to obtain and profit from the theft of sensitive personal, banking, and account credentials,” said Assistant Attorney General A. Tysen Duva of the Justice Departments Criminal Division.

While there was no specific reference to crypto-related accounts, its predecessor cybercrime marketplace Raidforums, which was shut down in 2022, previously hosted leaked data containing approximately “272,000 detailed personal information” of users of crypto wallet firm Ledger.

Crypto industry sees rise in leaked data

Over the past year alone, the crypto industry has seen a rise in leaked exchange credentials, insider data exposure and social engineering attempts.

Related: Crypto treasury inflows slow to the lowest since October 2024

In May 2025, cybercriminals reportedly bribed overseas customer service contractors to gain access to

crypto exchange

Coinbases internal systems. This allowed them to steal personal data that could be used in social engineering scams or even physical extortion attempts.

Around the same time, almost 60,000 Bitcoin addresses tied to LockBit‘s ransomware infrastructure were leaked after hackers breached the group’s dark web affiliate panel.

More recently, on Feb. 23, a trader who goes by the name TraderSZ said a former Revolut employee threatened to expose his identity and private information unless he paid a ransom and also contacted members of his family.