A significant international law enforcement operation has successfully dismantled LeakBase, a prominent online forum that served as a central hub for cybercriminals to trade stolen data and illicit tools. This action, spearheaded by the U.S. Federal Bureau of Investigation (FBI) and Europol, marks a crucial blow against the organized underworld of data trafficking.
As of December 2025, LeakBase boasted over 142,000 registered members and hosted more than 215,000 messages, according to U.S. Department of Justice records. Visitors attempting to access the forum’s clearnet website, leakbase[.]la, are now met with a seizure notice from the FBI, confirming its confiscation as part of a joint global effort.
Dismantling the Cybercriminal Marketplace
The seized forum content, including user accounts, posts, private messages, credit card details, and IP logs, has been secured by authorities for evidentiary purposes. Accessible in both English and over the clearnet, LeakBase was notorious for its extensive offerings of compromised databases. These collections frequently contained sensitive information such as hundreds of millions of account credentials, financial details like credit and debit card numbers, banking information, and login credentials, all readily available for facilitating account takeovers and other illicit activities.
A report from Flare in April 2023 indicated that LeakBase had a policy against the distribution of Russian databases, a measure likely intended to evade heightened scrutiny. The forum had been operational since 2021, building a substantial presence in the cybercrime ecosystem. Investigations have linked LeakBase to a threat actor known by various aliases, including Chucky, Chuckies, and Sqlrip, who has a history of distributing large troves of stolen data from global entities.
SpyCloud recently reported that the forum experienced a temporary outage, during which Chucky was reportedly seeking a new hosting provider. Other known administrators and moderators identified by researchers include BloodyMery, OrderCheck, and TSR, highlighting a coordinated network of individuals managing the platform.
Operation Leak and its Impact
The takedown, codenamed “Operation Leak,” was executed on March 3 and 4, 2026. This coordinated effort involved law enforcement agencies from the U.S., Australia, Belgium, Poland, Portugal, Romania, Spain, and the U.K., resulting in search warrants, arrests, and interrogations across these jurisdictions. Europol stated that LeakBase specialized in the sale of “stealer logs,” which are archives of credentials harvested by infostealer malware. This stolen data is a critical component for conducting account takeovers, financial fraud, and various other cyber intrusions.
In total, approximately 100 enforcement actions were carried out globally, with specific measures taken against 37 of the platform’s most active users. Assistant Director Brett Leatherman of the FBI’s Cyber Division emphasized the significance of this operation, stating, “The FBI, Europol, and law enforcement agencies from around the world executed a takedown of LeakBase, one of the largest online cybercriminal platforms, seizing users’ accounts, posts, credit details, private messages, and IP logs for evidentiary purposes.”
The successful dismantling of LeakBase represents a significant achievement in the ongoing fight against cybercrime. However, the dynamic nature of the dark web suggests that users of the forum may attempt to migrate to other platforms or establish new ones. Law enforcement agencies will likely continue to monitor these underground marketplaces for any resurgence of this illicit activity. The preservation of the forum’s data is a critical step that could lead to further investigations and prosecutions of individuals involved in data theft and trafficking.