FBI and Europol Seize LeakBase Forum Used to Trade Stolen Credentials

Source: The Hacker News

Background

A joint law‑enforcement operation has dismantled LeakBase, one of the world’s largest online forums for cybercriminals to buy and sell stolen data and cybercrime tools. According to the U.S. Department of Justice (DoJ), the forum had over 142 000 members and more than 215 000 messages between members as of December 2025. Visitors to the former site leakbase.la now see a seizure banner indicating it was confiscated by the FBI as part of an international effort.

“All forum content, including users’ accounts, posts, credit details, private messages, and IP logs, has been secured and preserved for evidentiary purposes.”

LeakBase was available in English on the clearnet and offered hacked databases, including hundreds of millions of account credentials, credit and debit card numbers, banking details, usernames, and passwords that could be used for account takeovers.

Forum Operations

• The forum explicitly prohibited users from posting or selling Russian databases, likely to avoid scrutiny — as noted in a Flare report (April 2023).
• Active since 2021, LeakBase operated under several aliases, including Chucky, Chuckies, and Sqlrip.
• According to SOCRadar, the threat actor behind these aliases has a history of sharing large collections of sensitive databases from global entities.
• SpyCloud reported in January 2026 that the forum had been down for a few days while Chucky searched for a new hosting provider. Known administrators and moderators included BloodyMery, OrderCheck, and TSR — see SL Cyber.

Law‑Enforcement Action

The takedown, codenamed Operation Leak, occurred on March 3‑4 2026. Authorities executed search warrants, made arrests, and conducted interviews across the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom.

• Europol announced that LeakBase specialized in the sale of stealer logs—archives of credentials harvested via infostealer malware—usable for account takeover, fraud, and other cyber intrusions.
• Around 100 enforcement actions were carried out worldwide, including unspecified measures against 37 of the platform’s most active users.
• Assistant Director Brett Leatherman of the FBI’s Cyber Division stated: “The FBI, Europol, and law‑enforcement agencies from around the world executed a takedown of LeakBase, one of the largest online cyber‑criminal platforms, seizing users’ accounts, posts, credit details, private messages, and IP logs for evidentiary purposes.” (see the FBI announcement).

References

• Archived forum site:
• Example of hacked databases:
• Flare dark‑web forums report:
• SOCRadar threat‑actor profile:
• SpyCloud cybercrime update (Jan 2026):
• Europol press release:
• FBI press release: