The Digital Gavel Falls: Global Strike Dismantles LeakBase Cybercrime Forum

In one of the most significant blows to the underground data-leak economy, the U.S. Department of Justice (DOJ), in a massive 14-country synchronized strike, has shuttered LeakBase, a notorious open-web marketplace for stolen credentials and cybercrime tools. The operation, hosted by Europol in The Hague, led to the seizure of the forum’s database, providing a treasure trove of evidence for investigators worldwide.

At the time of its seizure, LeakBase was a titan of the cybercriminal world, boasting over 142,000 members and more than 215,000 internal messages.

Unlike many illicit marketplaces that hide in the dark web, LeakBase operated openly in English, offering a “one-stop shop” for criminals to trade data from high-profile attacks.

The forum hosted an enormous, continuously updated archive of hacked databases containing hundreds of millions of account credentials.

Beyond usernames and passwords, users could buy and sell credit and debit card numbers, banking routing information, and sensitive business records. This data directly facilitated “additional account takeovers” and identity theft targeting both U.S. corporations and private individuals.

On March 3 and 4, law enforcement agents across 14 jurisdictions—including the U.S., UK, Australia, Poland, and Spain—launched synchronized actions to pull the plug on the platform.

Authorities shut down the platform and seized two primary domains, leakbase.ws and leakbase.la, which now display FBI seizure banners. Europol reported around 100 enforcement actions globally, including targeted “knock-and-talk” interventions and arrests of 37 of the platform’s most active users.

Investigators secured all user accounts, posts, and IP logs, stripping away the anonymity many users believed they enjoyed. In a unique psychological tactic, authorities sent direct “prevention messages” to the forum’s members during the disruption.

Federal officials emphasized that this operation is part of a broader, persistent strategy to dismantle the infrastructure that enables cybercrime.

The fall of LeakBase follows the successful disruption of predecessor marketplaces RaidForums in 2022 and BreachForums in 2023.