International law enforcement agencies have successfully dismantled LeakBase, a notorious online marketplace widely used by cybercriminals to trade stolen credentials and hacking resources. The coordinated crackdown was led by the Federal Bureau of Investigation and Europol as part of a multinational cybercrime investigation.
Authorities confirmed that the website leakbase[.]la has been seized. Visitors attempting to access the platform now encounter an official seizure notice stating that the infrastructure was confiscated as evidence in an international operation targeting cybercrime networks.
Massive Cybercrime Marketplace Taken Offline
According to the United States Department of Justice, the forum had grown into one of the largest hubs for trading compromised digital information. By December 2025, LeakBase reportedly had more than 142,000 registered members and over 215,000 forum messages exchanged between users.
Investigators revealed that all data stored on the platform, including:
- user accounts
- forum posts
- financial transaction records
- private messages
- IP address logs
has now been secured and preserved as digital evidence for ongoing criminal investigations.
LeakBase was publicly accessible through the regular internet and primarily operated in English. The forum served as a marketplace where criminals could obtain hacked databases containing hundreds of millions of stolen credentials, financial data, and personal records.
Stolen Data Sold on the Platform
Cybercriminals used the forum to distribute databases containing sensitive information such as:
- credit and debit card numbers
- bank account and routing details
- usernames and passwords
- login credentials for online services
This information was frequently exploited to perform account takeover attacks, identity theft, and financial fraud.
Cyber intelligence firm Flare previously reported in April 2023 that LeakBase had an unusual rule prohibiting users from selling Russian databases. Analysts believe this restriction may have been implemented to avoid attracting attention from certain authorities.
The forum had been active since June 2021, steadily growing into a major hub for credential trading within cybercriminal communities.
Administrator Known as “Chucky”
Investigators believe the forum was run by a cybercriminal known online as Chucky, who also used the aliases Chuckies and Sqlrip across underground forums.
Threat intelligence platform SOCRadar reported that this actor had a long history of distributing large collections of stolen databases containing sensitive information from organizations worldwide.
Additional administrators and moderators associated with the forum reportedly included users known as BloodyMery, OrderCheck, and TSR.
Earlier intelligence from SpyCloud indicated that LeakBase had temporarily gone offline in early 2026 while its operator searched for a new hosting provider.
Operation Leak Targets Cybercrime Infrastructure
The takedown occurred during a coordinated enforcement effort called Operation Leak, conducted on March 3 and 4, 2026. Authorities executed search warrants, carried out arrests, and interviewed suspects across several countries.
The international operation involved law enforcement actions in:
- United States
- Australia
- Belgium
- Poland
- Portugal
- Romania
- Spain
- United Kingdom
According to Europol, LeakBase specialized in selling stealer logs, which are archives of login credentials collected through infostealer malware infections. These logs often contain access tokens, passwords, and browser data stolen from infected devices.
Such information can be weaponized for cybercrime activities including:
- account takeover attacks
- financial fraud
- corporate network intrusions
Authorities reported that around 100 enforcement actions were conducted globally, including measures taken against 37 of the platform’s most active users.
Evidence Collected for Ongoing Investigations
Assistant Director Brett Leatherman from the FBI’s Cyber Division confirmed that investigators seized the platform’s infrastructure and preserved critical digital records.
Law enforcement agencies now have access to the forum’s entire dataset, including user identities, communication records, financial details, and network logs, which may help identify additional cybercriminal networks.
The takedown of LeakBase represents a significant disruption to the underground economy built around stolen credentials and infostealer malware data.
Found this article interesting? Follow us on X (Twitter) , Facebook, Blue sky and LinkedIn to read more exclusive content we post.
