Europol, FBI Purge Major Cybercrime Forum LeakBase From Web

LeakBase, one of the internet's largest cybercrime forums, has been dismantled in a sweeping international law enforcement operation involving the FBI, Europol, and agencies across 14 countries. The coordinated action on March 3 and 4 resulted in the seizure of user accounts, posts, credit details, private messages, and IP logs from the platform, which had amassed more than 142,000 members and 215,000 messages dedicated to trading stolen data and hacking tools.

Global Operation Targets LeakBase Infrastructure

The multinational crackdown shut down a platform that served as a one-stop shop for purchasing stolen credentials and cybercrime utilities. FBI cyber division assistant director Brett Leatherman confirmed in a statement on Wednesday that LeakBase was among the largest online criminal platforms ever dismantled, with all seized materials preserved for evidentiary purposes.

Following the operation, authorities replaced the site with seizure banners, distributed prevention notices to registered members, and gathered additional evidence. Law enforcement officers carried out search warrants and arrests in eight countries — the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom.

Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division stated that the takedown disrupts a major international platform that cybercriminals relied upon to obtain and profit from the theft of sensitive personal, banking, and account credentials.

The takedown of this cyber forum disrupts a major international platform that cybercriminals use to obtain and profit from the theft of sensitive personal, banking, and account credentials.

— A. Tysen Duva, Assistant Attorney General, DOJ Criminal Division

What Is the Connection Between LeakBase and Crypto?

LeakBase emerged as the successor to RaidForums, a cybercrime marketplace seized by authorities in 2022 that had previously hosted leaked data containing roughly 272,000 detailed personal records belonging to users of crypto hardware wallet provider Ledger. Although this latest takedown did not specifically reference crypto-related accounts, the forum's lineage underscores the persistent threat to digital asset holders.

Over the past year, the cryptocurrency sector has experienced a notable escalation in leaked exchange credentials, insider data exposure, and social engineering attacks. In May 2025, cybercriminals reportedly bribed overseas customer service contractors to infiltrate crypto exchange Coinbase's internal systems, stealing personal data that could fuel social engineering scams and even physical extortion attempts.

Crypto Industry Faces Mounting Data Security Threats

The dismantling of LeakBase comes amid a broader wave of data breaches affecting the digital asset ecosystem. Around the same period as the Coinbase breach, nearly 60,000 Bitcoin addresses linked to LockBit's ransomware infrastructure were exposed after hackers compromised the group's dark web affiliate panel. Europol has increasingly prioritized these cross-border cybercrime operations as stolen data continues to fuel attacks against crypto platforms and their users.

More recently, on February 23, a trader known as TraderSZ revealed that a former Revolut employee had threatened to expose his identity and private information unless he paid a ransom, and had also contacted members of his family. The incident highlights how stolen personal data from forums like LeakBase can directly enable real-world intimidation and extortion targeting crypto holders.

What This Means Going Forward

The successful takedown of LeakBase signals that global law enforcement is intensifying its pursuit of platforms that facilitate the trade of stolen data, particularly those with ties to the cryptocurrency ecosystem. With 14 countries acting in unison and arrests spanning multiple continents, authorities are demonstrating an unprecedented level of international coordination against cybercrime forums.

For crypto users, the operation serves as both a warning and a reassurance — a reminder that personal data remains a high-value target for criminals, but also evidence that investigators are closing in on the infrastructure that makes such theft profitable. The seizure of IP logs and private messages from LeakBase may lead to further arrests and prosecutions in the months ahead.