LeakBase Administrator Arrested in Russia Over Massive Stolen Credential Marketplace

Russian authorities have arrested the alleged administrator of the LeakBase cybercrime forum, a platform known for trading stolen personal and corporate data, state media reported.

Details of the Arrest

According to TASS and MVD Media, the suspect, a resident of Taganrog, was detained for creating and managing a criminal website that allowed stolen databases to be bought and sold since 2021. During a search of the suspect’s residence, law enforcement seized technical equipment and other items of evidentiary value.

Irina Volk, spokesperson for the Russian Ministry of Internal Affairs, stated that LeakBase hosted hundreds of millions of user accounts, bank details, usernames, passwords, and corporate documents obtained via hacking. Over 147,000 registered users could buy, sell, and misuse this data to commit fraud.

Law Enforcement Action

The takedown earlier this month removed one of the world’s largest hubs for cybercriminal activity. According to the U.S. Department of Justice (DoJ), LeakBase facilitated the sale of stolen credentials, financial information such as credit and debit card numbers, banking account details, and login credentials, which could be exploited for account takeover attacks.

By December 2025, the forum had more than 142,000 members and over 215,000 messages exchanged between users. Visitors to the seized site were greeted with a notice stating that all content, including accounts, messages, credit details, and IP logs, had been secured for evidentiary purposes.

LeakBase seizure notice issued by Russia’s Ministry of Internal Affairs (MVD)
LeakBase seizure notice issued by Russia’s Ministry of Internal Affairs (MVD)

Background on the Suspect

LeakBase is reportedly run by a threat actor using aliases such as Chucky, beakdaz, Chuckies, and Sqlrip. Investigations by KELA and TriTrace linked Chucky to a 33-year-old individual from Taganrog.

Post-Seizure Activity

Shortly after the seizure, LeakBase resurfaced on the domain leakbase[.]bz, using DDoS-Guard, a Russian bulletproof hosting provider, for protection against attacks. The site now displays a message noting that the forum was permanently closed by the Russian Ministry of Internal Affairs’ Bureau of Special Technical Events, warning that computer crime and violations of constitutional rights carry criminal liability under Russian law.




Found this article interesting? Follow us on  X (Twitter) FacebookBlue sky and LinkedIn to read more exclusive content we post.