FBI Seizes LeakBase Cybercrime Forum in Global “Operation Leak” Takedown Coordinated by Europol

The FBI has seized the LeakBase cybercrime forum, which had over 142,000 members, as part of an international operation called “Operation Leak” involving 14 countries and coordinated by Europol.

The forum, used for selling hacking tools and stolen data, was shut down through domain seizures and law enforcement actions including arrests and search warrants. The forum’s data will be used for future investigations, and its domain now displays a seizure notice from the FBI.

On March 3 and 4, the FBI and law enforcement agents shut down LeakBase by seizing two of its domains, posting seizure banners, and warning LeakBase members of the seizure after collecting further evidence. Police officers and investigators also executed search warrants, made arrests, and conducted interviews in the United States and across Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom.

LeakBase’s domain (leakbase[.]la) now displays a notice stating “This website has been seized by the Federal Bureau of Investigation (FBI) as part of an international law enforcement operation.”

The seizure banner also notes that the forum’s database and all its contents, including IP logs and private messages, will be used for “evidentiary purposes” in future investigations.

“All forum content including users’ accounts, posts, credit details, private messages and IP logs have been secured and preserved for evidentiary purposes,” the notice reads. “Attempts to access, alter, or interfere with this site may result in additional criminal offenses. This action was possible because of international law enforcement and private sector coordination involving the partners listed below.”

The domain nameservers have also been switched to ns1.fbi.seized.gov and ns2.fbi.seized.gov, the nameservers used by the FBI when seizing domains.

“On 3 March, law enforcement authorities carried out coordinated enforcement actions across multiple jurisdictions, including arrests, house searches, and ‘knock-and-talk’ interventions. Around 100 enforcement actions were conducted worldwide, including measures against 37 of the most active users of the platforms,” Europol added. “On 4 March, authorities moved to the technical disruption phase, seizing the forum’s domain and replacing it with a law enforcement splash page. The operation now enters a prevention phase aimed at deterring further criminal activity and raising awareness of the consequences of engaging in cybercrime.”

Active since 2021, LeakBase was launched as a project supported by the ARES threat group, and it gradually grew its user base to more than 142,000 members following the closure of the Breached hacker forum.

The forum was free to join and offered access to databases, a market for selling leaks, exploits, and other cybercrime services, and an escrow payment system. In addition, it also hosted spaces for programming, hacking tips, social engineering, cryptography, and opsec guides.