Authorities from 14 countries shut down LeakBase, seize its domains, and arrest multiple people allegedly tied to the cybercrime forum, which had 142K+ members
The marketplace was one of the world's largest hubs for cybercrime with more than 142,000 members.
CyberScoopMatt Kapko
Context & Ripple Effects
LeakBase’s removal fits a recurring enforcement pattern against forums that aggregate stolen data, buyers, and sellers. The earlier RaidForums seizure and the FBI’s BreachForums action show authorities repeatedly targeting the infrastructure and communities that make cybercrime markets liquid.
What distinguishes this case in the coverage is the 14-country coordination and the combination of domain seizures with arrests. That pairing aims to disrupt both access to the forum and the people alleged to operate or support it.
First-order effects
LeakBase members immediately lose a central venue for listing, finding, and exchanging illicit material; seized domains also cut off the forum’s public-facing access points.
The arrested individuals face investigation, while authorities gain potential access to infrastructure and evidence connected to the alleged operation.
Second-order effects
Users and vendors are likely to seek replacement channels, fragmenting activity across smaller forums and private messaging spaces—a pattern following prior BreachForums disruption.
Other forum operators must reassess exposure in domains, servers, and identifiable administration as cross-border enforcement demonstrates an ability to combine seizures with arrests.
Third-order effects
Repeated takedowns can raise the operating cost of large, centralized cybercrime marketplaces, but the prior RaidForums case suggests that removing a forum does not by itself eliminate demand for stolen data and criminal services.
If international coordination remains sustained, enforcement may increasingly focus on the ecosystem’s infrastructure and operators rather than only individual leaks; whether this produces durable deterrence depends on follow-through against successor venues.
The trend: Cross-border law enforcement is increasingly treating major cybercrime forums as infrastructure targets, using coordinated seizures and arrests to disrupt the markets that connect criminal suppliers and buyers.
LeakBase has been hosted by and used as the registrar with Njalla for quite awhile. So that's one take away from this. The other takeaway is Chucky (the admin) probably isn't arrested, and will likely bring up a new domain.
The FBI (and apparently every other government agency on planet) has seized LeakBase, the long standing competitor to Breached, with the difference being LeakBase was more tailored to Eastern Europeans. Hot take: Operation Leak is an unoriginal and lazy name [image]
Major forum Leakbase has been dismantled in a coordinated operation. The platform was disrupted through joint action across multiple countries. — Learn more ➡️ https://www.europol.europa.eu/media- press/newsroom/news/major-data-leak- forum-dismantled-in-global-action- against-…
‼️ Here is some more information on the LeakBase seizure from Europol, along with some images from the actions of law enforcement. On 3 March, law enforcement authorities carried out coordinated enforcement actions across multiple jurisdictions, including arrests, house searches …
United States Leads Dismantlement of One of the World's Largest Hacker Forums “The takedown of this cyber forum disrupts a major international platform that cybercriminals use to obtain and profit from the theft of sensitive personal, banking and account credentials,” said [image…
‼️BREAKING: LeakBase is showing that it has been seized by law enforcement via updated Whois information. There is currently no seizure banner showing. [image]
[Europol... described LeakBase as a “central hub in the cybercrime ecosystem” that specialized in leaked databases and stealer logs. The English-language site, which has been active since 2021, contained more than 32,000 posts and more than 215,000 private messages.] — cybersc…