FBI, Europol Shut Down LeakBase With 142,000 Members
Law enforcement from 14 countries dismantled LeakBase, a cybercrime forum that traded stolen data from crypto firms. The operation captured user accounts, private messages, credit details, and IP logs for prosecution.
Key Takeaway
Authorities seized 215,000 messages and IP logs that could lead to arrests of cybercriminals targeting crypto platforms.
FBI Cyber Division Assistant Director Brett Leatherman said the agency seized users' accounts, posts, credit details, private messages, and IP logs for evidentiary purposes during the March 3-4 takedown. The operation involved law enforcement from the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, United Kingdom, and six other unnamed countries.
LeakBase hosted over 215,000 messages trading stolen data from crypto platforms, including 272,000 detailed personal information records of Ledger crypto wallet users originally leaked on Raidforums, LeakBase's predecessor that authorities seized in 2022. The forum also contained almost 60,000 Bitcoin addresses tied to LockBit ransomware infrastructure.
In May 2025, criminals bribed Coinbase overseas customer service contractors to access internal systems. A crypto trader known as TraderSZ reported on February 23 that a former Revolut employee threatened to expose his identity and private information unless he paid a ransom.
Justice Department Criminal Division Assistant Attorney General A. Tysen Duva said the takedown disrupts a major international platform that cybercriminals use to obtain and profit from the theft of sensitive personal, banking, and account credentials. The forum operated a credit-based economy where members earned reputation scores by sharing stolen data.
The operation targeted 37 active users with arrests and searches on March 3, followed by the domain seizure and database takedown on March 4 that enabled user deanonymization. LeakBase had launched in June 2021 and gained traction as an alternative during BreachForums' disruptions, with suspected Russian origins based on rules banning data related to Russia. The FBI and Europol coordinated actions across 14 countries to dismantle the platform on March 4, 2026.
This article was written based on reporting from Cointelegraph.
