An international, cross-border operation led by the U.S. Federal Bureau of Investigation (FBI) and Europol has dismantled LeakBase, one of the internet’s most active hubs for cybercrime. The coordinated takedown targeted a forum that facilitated the sale of stolen data and cybercrime services, drawing more than 142,000 registered members and generating extensive activity with over 215,000 posts. Officials described the operation as one of the largest takedowns of its kind, underscoring the global reach of digital criminal marketplaces and the growing cooperation among law enforcement agencies to disrupt them. The action culminated in simultaneous actions across 14 countries on March 3 and 4, with authorities replacing the site with seizure notices and collecting critical data for evidence.

Key takeaways

• LeakBase hosted a large community of cybercriminals, with 142,000+ members and more than 215,000 posts before the takedown.
• The operation ran on March 3–4 and involved synchronized actions by law enforcement across 14 countries, including warrants, arrests, and site seizures.
• Authorities replaced LeakBase with seizure banners and gathered user data, posts, and IP logs to support prosecutions and future investigations.
• U.S. and international agencies emphasized that the platform served as a conduit for stolen credentials, financial data, and other sensitive information.
• The case sits within a broader pattern of increased leakage and credential exposure affecting the crypto ecosystem, prompting ongoing scrutiny of security practices across exchanges and wallets.

Tickers mentioned: $BTC, $ETH, $COIN

Market context: The takedown aligns with a heightened global emphasis on cross-border cybercrime investigations and the crypto sector’s momentum toward stronger protection of customer data and infrastructure resilience amid rising leakage incidents.

Why it matters

The LeakBase operation highlights the persistent threat posed by large online crime forums that streamline the sale of stolen data, including credentials and financial information. While no specific crypto accounts were cited in the immediate statements, the incident fits a troubling trend in which attackers leverage leaked data to perpetrate social engineering, targeted phishing, and account takeovers within crypto ecosystems. A Justice Department briefing noted that the takedown disrupts a major international platform used by cybercriminals to monetize stolen information, thereby reducing the pool of readily available data for criminals who aim to compromise wallets, exchanges, or payment networks. The broader implication is a push for more proactive security measures across crypto service providers and financial platforms alike, as well as greater transparency around the provenance of user data and the steps required to protect it.

The crackdown also serves as a reminder of prominent, previously shuttered marketplaces, such as Raidforums, whose shutdown in 2022 and subsequent data revelations underscored how leaked information can ripple through the crypto space. In that prior case, exposed data included tens or hundreds of thousands of records tied to crypto-wallet users, illustrating how platform safeguards and user due diligence intersect with criminal risk. Although the LeakBase action did not explicitly cite a crypto-specific breach, the interconnected nature of cybercrime means that leaked credentials and payment details can be repurposed for fraudulent activities across exchanges, wallets, and custodial services. This dynamic has kept the security posture of several platforms under closer scrutiny and spurred calls for enhanced multi-factor authentication, better anomaly detection, and tougher access controls across the board.

From a policy perspective, the operation reinforces the value of international cooperation in cybercrime investigations. Law enforcement officials engaged in search warrants and arrests across eight distinct jurisdictions, reinforcing that cyber threats do not respect borders. While the immediate focus was on dismantling a criminal forum, the long-term effect is a broadened mandate for cross-jurisdictional data sharing, real-time intelligence collaboration, and more aggressive enforcement against online marketplaces that facilitate illicit activity. In crypto markets, where user trust hinges on verifiable security practices, the incident reinforces the imperative for exchanges and wallets to invest in better credential protection, phishing resistance, and response playbooks that can quickly isolate compromised accounts and limit damage.

In parallel, security researchers note that the human factor remains a primary vector for breaches. The narrative surrounding leaked data—whether from exchanges or support channels—underscores how social engineering and insider risk can undermine even the most robust technical defenses. As security teams evaluate their incident response plans, the LeakBase takedown offers a concrete case study in how coordinated, multinational action can disrupt criminal networks, while also raising questions about the balance between takedowns and safeguarding legitimate users who may be affected by seizures and account suspensions.

What to watch next

• Official statements and charging documents from the Department of Justice and participating jurisdictions outlining specific prosecutions and charges related to LeakBase users and operators.
• Updates on any additional seizures, arrests, or indictments tied to the operation, including cross-border investigations into connected forums or marketplaces.
• Post-takedown data disclosures or advisories from impacted platforms or security firms detailing how compromised data was used and what remediation steps were taken.
• Regulatory or policy developments aimed at tightening cybercrime cooperation, data protection standards, and credential theft prevention within crypto exchanges and wallet providers.

Sources & verification

• U.S. Department of Justice press release on the dismantlement of LeakBase and related law enforcement actions (official source)
• Statement from the FBI Cyber Division confirming the takedown and evidentiary preservation (official source)
• Ledger data leak reference tied to Raidforums and its historical impact on crypto-users’ data exposure
• Cointelegraph reporting on Coinbase breach activities and related social engineering risk

LeakBase takedown and the global hunt for cybercrime marketplaces

An international coalition spearheaded by the FBI and Europol orchestrated a landmark takedown of LeakBase, a sprawling cybercrime forum that served as a marketplace for stolen data, hacking tools, and illicit services. The operation, conducted across March 3 and 4, mobilized authorities in 14 countries, signaling both the scale of the network and the depth of international cooperation now applied to cybercriminal infrastructure. After the seizures, authorities replaced the site with seizure banners and initiated the collection of logs, messages, and user data to support ongoing investigations and potential prosecutions. The operation marks a notable milestone in the fight against online marketplaces that enable financial fraud, credential theft, and targeted scams across digital ecosystems.

Officials stressed that the dismantled platform operated as a conduit for the theft and monetization of sensitive personal, banking, and account data. The DOJ’s Criminal Division emphasized that these networks typically enable numerous downstream crimes, including social engineering campaigns that exploit exposed data to manipulate victims or extract money. In the context of the crypto space, where custody and access rely on credentials and reputation, the disruption of such forums is seen as a meaningful step toward reducing the pool of readily available information criminals can weaponize to compromise exchanges, wallets, and accounts.

While the primary focus of the LeakBase takedown was not a single cryptoasset, the ripple effects touch a sector already grappling with credential leakage and social engineering. The broader security environment remains fragile, with past incidents linked to data exposures and compromised customer information that can be weaponized against crypto holders. The operation’s multinational scope highlights a shift toward more aggressive, coordinated enforcement that crosses legal jurisdictions, a development welcomed by security professionals who argue that collaboration is essential to disrupt criminal ecosystems that thrive on anonymity and scale.

Looking ahead, investigators will parse through seized data to map relationships between users, trace stolen credentials, and identify potential targets across financial platforms. The case may yield further charges and unravel ancillary networks that connect LeakBase to other forums or marketplaces. As the crypto sector continues to push for stronger security controls and better data hygiene, this takedown provides a real-world demonstration of how law enforcement, policy, and industry players can align to curb cybercrime’s reach while preserving legitimate users’ trust in digital asset ecosystems.

TLDR:

• Crossover Markets closed a $31M Series B round at a $200M valuation, led by Tradeweb Markets.
  
• Tradeweb will route institutional spot crypto orders to CROSSx using algorithmic order-routing tech.
  
• CROSSx has matched over $50 billion in notional volume across 12 million trades since its launch.
  
• Investors include Ripple, Virtu Financial, Wintermute Ventures, XTX Markets, and DRW Venture Capital. 

Crossover Markets has closed a $31 million Series B funding round at a $200 million valuation. Tradeweb Markets led the round, joined by DRW Venture Capital, Illuminate Financial, Ripple, Virtu Financial, Wintermute Ventures, and XTX Markets.

The investment strengthens CROSSx, an execution-only cryptocurrency electronic communication network. Through the deal, Tradeweb will route institutional spot crypto orders to the platform.

This partnership reflects the growing convergence between traditional finance and digital asset trading infrastructure.

Tradeweb Partnership Brings Institutional Crypto Access to Global Clients

Tradeweb plans to connect its global clients to Crossover’s institutional spot crypto liquidity. It will use its algorithmic order-routing technology to direct trades to CROSSx.

This move marks Tradeweb’s formal entry into institutional crypto markets. The integration combines CROSSx’s microsecond matching speed with Tradeweb’s established global distribution network.

Crossover Markets CEO Brandon Mulvihill welcomed the development with a clear statement of intent.

“We are pleased to announce our Series B financing and are grateful to both our existing and new investors, whose support is a testament to the transformative role CROSSx is playing in the digital asset ecosystem.” — Brandon Mulvihill, Co-Founder and CEO, Crossover Markets

Mulvihill further noted that institutions are demanding speed, transparency, and efficiency similar to traditional markets. He added that few Wall Street leaders understand those standards better than Tradeweb.

Combining CROSSx’s single-digit microsecond matching with Tradeweb’s global reach marks a significant step forward. He also stressed that clear separation of duties remains fundamental to sound market structure.

Tradeweb CEO Billy Hult echoed that view, framing the deal as a natural progression.

“This collaboration marks Tradeweb’s entry into institutional crypto, a natural next step in our multi-asset strategy. Institutional investors are increasingly turning to crypto to express macro views and manage risk in a 24/7 global market.” — Billy Hult, CEO, Tradeweb

Hult added that as adoption grows, markets now require trusted, institutional-grade infrastructure. The planned integration aims to extend Tradeweb’s electronic execution standards into the crypto space.

Clients can expect the liquidity, transparency, and discipline Tradeweb is known for delivering. That commitment aligns directly with what CROSSx was built to provide.

Crossover also shared its excitement across social media, reinforcing the milestone.

“This milestone marks the continued convergence of traditional finance and digital assets.” — Crossover Markets (@crossover_mkts)

Proceeds to Fund Technology Growth and Expanded Global Operations

Crossover Markets will direct funding toward enhancing its core technology infrastructure. Additionally, the company plans to expand its global operations and deepen institutional integrations.

Since launching, CROSSx has matched over $50 billion in notional trading volume. The platform now supports nearly 100 live participants across 12 million completed trades.

Crossover Markets also highlighted participation from firms like Virtu Financial and XTX Markets. These traditional finance players bring regulatory expertise and disciplined risk management to the table.

Their involvement helps bridge conventional capital markets with cryptocurrency trading infrastructure. Together, they strengthen the institutional credibility of the CROSSx platform.

Crypto-native firms Ripple and Wintermute Ventures also joined the round as participants. Their inclusion reflects confidence from within the digital asset community itself.

CROSSx supports low-latency execution, advanced order types, and FIX protocol connectivity. These features cater directly to institutional participants requiring reliable, professional-grade trading tools.

With this financing in place, Crossover Markets is now better positioned to lead institutional crypto trading. The company aims to solidify CROSSx as the venue of choice for digital asset execution.

As traditional and crypto markets continue merging, Crossover Markets stands at the center of that shift.

US technology giants have signed a White House pledge to cover the power costs of their artificial intelligence data centers, which the Trump administration says will prevent consumers from paying higher utility bills.

The non-binding “Ratepayer Protection Pledge” was signed by Amazon, Google, Meta, Microsoft, OpenAI, Oracle and xAI on Wednesday, promising the companies would “build, bring, or buy” the energy needed to build and operate data centers and would not pass on costs to consumers.

“The data centers […] need some PR help,” US President Donald Trump said at a roundtable attended by government officials and representatives from Big Tech firms. 

“People think that if a data center goes in, their electricity prices are going to go up, and that’s not happening. It’s not going to happen — and for the areas where it did happen, it won’t happen anymore,” he added.

Data centers are cropping up across the US amid an AI boom, with the power-hungry technology exceeding the available capacity in some parts of the country, according to a Harvard Kennedy School report from February. 

The report said that data centers could demand up to 12% of all US electricity consumption by 2028. US Energy Information Administration data show that residential energy prices increased 6% in 2025 and are expected to continue rising through 2027 and 2028.

Voters concerned about bills ahead of midterms

Trump announced the pledge in his State of the Union address, and it comes ahead of the midterm elections in November, where voters are concerned about cost-of-living pressures and the impact of AI data centers on the energy grid.

“Some centers were rejected by communities for that, and now I think it’s going to be just the opposite,” Trump said, referring to data centers canceled after locals opposed the projects.

Related: Mining companies move deeper into AI, HPC as MARA may sell Bitcoin

The pledge promises that companies will pay for all new power infrastructure required for their data centers and will pay the cost for the infrastructure and power brought online, whether they use it or not.