The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On January 30, 2025, the U.S. Department of Justice announced an international operation to disrupt Cracked and Nulled, two online marketplaces that it said advertised stolen data and cybercrime tools. DOJ attributed an impact of at least 17 million U.S. victims to Cracked—not to Nulled, and not as a count of people directly hacked by the forums themselves.
What happened in the operation?
The United States worked with authorities in Romania, Australia, France, Germany, Spain, Italy, and Greece in an operation DOJ called part of Operation Talent, a multinational investigation supported by Europol. Authorities targeted the marketplaces’ infrastructure and related services.
- For Cracked, authorities seized servers and eight domains used to operate the marketplace.
- Authorities also seized servers and domains associated with Sellix, a payment processor, and a related bulletproof hosting service.
- For Nulled, authorities seized marketplace infrastructure and its operating domain.
DOJ announced the operation on January 30, 2025. Its release was updated April 25, 2025. DOJ’s announcement
What does the 17 million figure mean?
DOJ said seizure-warrant information indicated that Cracked had impacted at least 17 million victims in the United States. That is the government’s stated impact estimate, not an independently audited victim count. The announcement does not say that every person counted was directly attacked by the forums or establish which individuals were affected.
#1 Best Overall
The figures for marketplace users and posts describe the scale of the sites, not the number of victims. DOJ reported more than four million Cracked users and more than 28 million posts advertising cybercrime tools and stolen information. It reported more than five million Nulled users and more than 43 million such posts. DOJ’s figures for Cracked and Nulled are attributed to seizure warrants summarized in the release.
How did Cracked and Nulled differ?
| Marketplace | Operating period | Scale reported by DOJ | Products or claims described by DOJ | Revenue reported by DOJ | Action announced |
|---|---|---|---|---|---|
| Cracked | Operating since March 2018 | Over four million users; over 28 million posts | Stolen login credentials, hacking tools, servers for hosting malware and stolen data, and other tools for cybercrime and fraud. An advertised credential-search product allegedly offered access to “billions of leaked websites.” | Approximately $4 million | Servers and eight operating domains seized |
| Nulled | Operating since 2016 | Over five million users; over 43 million posts | Cybercrime tools and stolen information. One advertised product purported to contain names and Social Security numbers of 500,000 Americans; DOJ’s announcement does not establish that listing’s accuracy. | Approximately $1 million per year | Marketplace infrastructure and operating domain seized; administrator charged |
These operating, scale, and revenue figures are DOJ’s 2025 account based on seizure-warrant information, not an independent audit. The 17-million impact estimate applies specifically to Cracked and should not be conflated with either forum’s user count or the data described in a Nulled listing. DOJ’s release
What alleged harm did DOJ describe?
DOJ said a cybercriminal allegedly used Cracked’s credential-search tool to obtain a woman’s account credentials, then cyberstalked, sextorted, and harassed her. This is an incident described as an allegation by DOJ, not an adjudicated finding.
The episode illustrates the risk of stolen credentials being reused or searched for access to accounts. It does not establish that every credential advertised on a marketplace worked, that every listing was accurate, or that every person whose data may have appeared there was targeted.
Rank #3
What charges were announced against the Nulled administrator?
DOJ said Lucas Sohn, an Argentinian national residing in Spain, was an active Nulled administrator who performed escrow functions. The department announced charges concerning alleged trafficking in passwords and similar information, access-device fraud, and identity fraud. A charge is an allegation, not a finding of guilt; DOJ stated that defendants are presumed innocent unless proven guilty beyond a reasonable doubt in court. The DOJ release
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the takedown does—and does not—establish
The operation disrupted the named marketplaces and related infrastructure, according to DOJ. The announcement does not provide an independently verified accounting of victims or revenue, identify each affected person, or establish individual exposure status. It also does not report later outcomes in Sohn’s case. The seizure announcement is therefore evidence of a law-enforcement action and allegations described by the department, not a complete public record of every victim or the final disposition of the charges.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
