The FBI has seized and taken control of Leakbase, one of the largest English-speaking cybercrime forums in recent history. The takedown marks a significant milestone in the ongoing global effort to dismantle underground markets for stolen data.
Seizure banner on the Leakbase homepage
Details of the Takedown: Operation Leak
On March 3 and 4, 2026, law enforcement agencies across 14 countries executed a coordinated takedown operation hosted by Europol in The Hague, Netherlands. The FBI’s Salt Lake City field office led the United States’ contribution to the effort. Legal authority for the operation was derived from court orders issued by both a German court and the United States District Court for the District of Utah, reflecting the multinational legal framework required to dismantle a platform of this scale.
The seizure banner now displayed on the Leakbase domain carries a pointed message for former users: authorities claim to have access to user accounts, credit card details, private messages, and IP address logs. For anyone who believed their activity on the platform was anonymous, the warning is clear.
Authorities have also launched a public tip line at [email protected], urging anyone with relevant information about site administrators or users to come forward. The move signals that the investigation is far from over and that law enforcement is actively building cases against individuals connected to the platform.
Both of the forum’s primary domains resolve to FBI seizure nameservers
Both of the forum’s primary domains, Leakbase[.]la and Leakbase[.]ws, now resolve to FBI seizure nameservers, effectively locking all visitors out of the site.
Europol confirmed that the operation resulted in arrests, residential searches, and “knock-and-talk” interventions. Notably, enforcement actions were taken against 37 of the platform’s most active users, suggesting investigators had been monitoring the forum’s most prolific members well before the public announcement.
Law enforcement involved with the takedown
What Made Leakbase Significant
Leakbase was not simply another fringe internet forum. It had grown into one of the most active and well-organized marketplaces for buying and selling stolen data on the open web. At the time of the takedown, the platform boasted over 142,000 registered members and more than 215,000 messages exchanged between users. Its catalog of leaked databases, compromised credentials, and personally identifiable information made it a go-to destination for cybercriminals ranging from low-level fraudsters to more sophisticated threat actors.
Much of Leakbase’s rapid growth can be attributed to the collapse of its predecessors. When RaidForums was seized by authorities in 2022, its displaced user base migrated en masse to BreachForums. When BreachForums was subsequently shut down, those same users sought refuge on Leakbase, bringing their networks, reputation, and illicit trade with them. In this way, Leakbase inherited the communities and the credibility of the forums that came before it.
Law enforcement involved with the takedown
Ecosystem Fallout
Seasoned observers of the cybercrime underground were not entirely caught off guard. Hours before the official seizure announcement, users across various Telegram channels had already begun speculating that Leakbase had been compromised or taken down by law enforcement. The chatter spread quickly, with many users urging others to assume their data had been collected and to take precautions accordingly. Threat intelligence platforms like Flare provide visibility into these underground communication channels, offering insight into how cybercriminal communities process and respond to enforcement actions in real time.
The broader lesson from these successive takedowns is a familiar one: shutting down a cybercrime forum does not eliminate the community it housed. It simply displaces it. Much like cutting off one head of the hydra, each takedown prompts the ecosystem to reorganize and resurface elsewhere. RaidForums fell and BreachForums rose. BreachForums fell and Leakbase took its place. Now, with Leakbase gone, the underground is already searching for its next platform.
The question facing law enforcement and the cybersecurity community alike is not just where that migration leads, but whether the next destination can be identified and disrupted before it reaches the scale that Leakbase ultimately achieved. What is clear is that as long as demand for stolen data persists, the ecosystem will continue to adapt.
