FBI and Europol jointly shut down the hacker forum LeakBase; law enforcement actions in 14 countries target 140,000 user data

On March 5, news reports that the FBI and Europol, along with multiple law enforcement agencies from different countries, launched a cross-border operation to successfully shut down the LeakBase cybercrime forum. The platform had been used by hackers for a long time to trade stolen data, account information, and hacking tools, with over 142,000 registered members and approximately 215,000 related posts. Law enforcement agencies identified it as one of the most active online crime communities worldwide.

Brett Leatherman, Assistant Director of the FBI Cyber Crime Division, stated that the operation targeted LeakBase’s core infrastructure. Authorities seized the forum’s servers and collected extensive evidence, including account details, post records, credit card data, private information, and IP logs, for further investigation and tracking of involved individuals.

The operation took place from March 3 to 4, involving law enforcement officers from 14 countries. After the operation, the website displayed a seizure notice on its homepage, and warnings were issued to platform users. Additionally, multiple search warrants were executed, and arrests made in the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom. A. Tyson Duvall, Assistant Attorney General for the Criminal Division of the U.S. Department of Justice, said that shutting down LeakBase cut off a long-standing platform used by cybercriminals to trade sensitive data. The forum had been used to sell personal identities, bank account information, and login credentials.

Although the law enforcement announcement did not explicitly mention cryptocurrency accounts, industry experts note that similar hacker forums often involve trading of crypto wallet data and user information. LeakBase’s predecessor, Raidforums, was shut down in 2022 and hosted numerous data breach files, including about 272,000 detailed personal records related to Ledger, a crypto wallet company.

Over the past year, the risk of data breaches in the digital asset industry has significantly increased. In May 2025, cybercriminals bribed overseas customer service contractors to gain access to the internal systems of a major crypto platform, stealing user data and conducting social engineering attacks. Additionally, hackers infiltrated the dark web accounts of the LockBit ransomware group, exposing approximately 60,000 Bitcoin addresses associated with its infrastructure. Security researchers believe that as the scale of digital assets grows, international law enforcement cooperation on crypto wallet security, user privacy protection, and cybercrime investigations continues to strengthen.