FBI seizes LeakBase cybercrime forum, data of 142,000 members

Source: Bleeping Computer

The FBI has seized the LeakBase cybercrime forum, a major online forum used by cybercriminals to buy and sell hacking tools and stolen data. This seizure action is part of an international joint operation coordinated by Europol, known as Operation Leak, which involved law‑enforcement agencies in 14 countries.

Seizure Action

On March 3 and 4, the FBI and partner agencies shut down LeakBase by seizing two of its domains, posting seizure banners, and warning members after collecting further evidence. Police officers and investigators also executed search warrants, made arrests, and conducted interviews in the United States and across Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom.

LeakBase’s domain (leakbase[.]la) now displays a notice stating:

“This website has been seized by the Federal Bureau of Investigation (FBI) as part of an international law enforcement operation. All forum content including users’ accounts, posts, credit details, private messages and IP logs have been secured and preserved for evidentiary purposes. Attempts to access, alter, or interfere with this site may result in additional criminal offenses.”

The seizure banner notes that the forum’s database and all its contents—including IP logs and private messages—will be used for evidentiary purposes in future investigations.

The domain’s nameservers have been switched to ns1.fbi.seized.gov and ns2.fbi.seized.gov, the standard nameservers used by the FBI when seizing domains.

International Coordination

“On 3 March, law‑enforcement authorities carried out coordinated enforcement actions across multiple jurisdictions, including arrests, house searches, and ‘knock‑and‑talk’ interventions. Around 100 enforcement actions were conducted worldwide, including measures against 37 of the most active users of the platforms,” — Europol.

“On 4 March, authorities moved to the technical disruption phase, seizing the forum’s domain and replacing it with a law‑enforcement splash page. The operation now enters a prevention phase aimed at deterring further criminal activity and raising awareness of the consequences of engaging in cybercrime.”

LeakBase Forum Overview

Active since 2021, LeakBase was launched as a project supported by the ARES threat group. It grew to more than 142,000 members after the closure of the Breached hacker forum.

The forum was free to join and offered:

• Access to databases and a marketplace for selling leaks, exploits, and other cybercrime services.
• An escrow payment system.
• Dedicated spaces for programming, hacking tips, social engineering, cryptography, and operational security (OPSEC) guides.

Historical Context

LeakBase’s takedown follows previous disruptions of major cybercrime marketplaces:

• RaidForums – dismantled in 2022 (DOJ press release).
• BreachForums – seized in 2023 (DOJ press release).
• The founder of BreachForums was convicted and sentenced in 2025 (BleepingComputer article).