An international law enforcement operation involving the US Federal Bureau of Investigation, Europol and other agencies has taken down one of the internet’s most notorious cybercrime forums, LeakBase.
The forum was a place for hackers to buy and sell stolen data and cybercrime tools, amassing more than 142,000 members and over 215,000 messages.
“The FBI, Europol, and law enforcement agencies from around the world executed a takedown of LeakBase, one of the largest online cybercriminal platforms, seizing users’ accounts, posts, credit details, private messages, and IP logs for evidentiary purposes,” the FBI cyber division assistant director Brett Leatherman said in a statement on Wednesday.
LeakBase takedown involved 14 countries
The takedown operation, which ran on March 3 and 4, involved law enforcement agents and officers in 14 countries taking synchronized actions against LeakBase and its users.
Following the operation, authorities replaced the site with seizure banners, issued prevention notices to members, and collected additional evidence.
Law enforcement also executed search warrants and arrests in the United States, Australia, Belgium, Poland, Portugal, Romania, Spain and the United Kingdom.
“The takedown of this cyber forum disrupts a major international platform that cybercriminals use to obtain and profit from the theft of sensitive personal, banking, and account credentials,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.
While there was no specific reference to crypto-related accounts, its predecessor cybercrime marketplace Raidforums, which was shut down in 2022, previously hosted leaked data containing approximately “272,000 detailed personal information” of users of crypto wallet firm Ledger.
Crypto industry sees rise in leaked data
Over the past year alone, the crypto industry has seen a rise in leaked exchange credentials, insider data exposure and social engineering attempts.
Related: Crypto treasury inflows slow to the lowest since October 2024
In May 2025, cybercriminals reportedly bribed overseas customer service contractors to gain access to crypto exchange Coinbase’s internal systems. This allowed them to steal personal data that could be used in social engineering scams or even physical extortion attempts.
Around the same time, almost 60,000 Bitcoin addresses tied to LockBit’s ransomware infrastructure were leaked after hackers breached the group’s dark web affiliate panel.
More recently, on Feb. 23, a trader who goes by the name TraderSZ said a former Revolut employee threatened to expose his identity and private information unless he paid a ransom and also contacted members of his family.
