After years of seizures, arrests and internal disputes, the English-speaking cybercrime forum scene has become increasingly fragmented. PwnForums is one of the platforms trying to fill that gap.
Inside Darknet spoke with the people behind PwnForums.
1For the people who have never visited a hacking forum, who are you and what exactly is PwnForums?
PwnForums is the very embodiment of a classic hacking forum.
The word “pwn” originally means taking control of or defeating something in hacker culture. Why did you choose PwnForums as the name?
It's partly a play on words that's instantly recognizable in the scene and partly just memorable. A forum name needs to stick and "Pwn" does that while immediately communicating the theme.
PwnForums appeared after another version of BreachForums suffered an attempted takeover and exit scam. Can you explain what happened?
Around the date March 15 2026 breachforums[.]as was shut down by its' administrator "N/A" (aka "Indra") in attempt to pull off an exitscam. BreachForums stayed offline until 10 days later on March 25 2026 when "N/A" decided to relaunch the forum using a backup from February 11th on the domains breachforums[.]fi & breachforums[.]sb, this time using the alias "Caine".
Upon the BreachForums staff becoming aware that "Caine" was the exitscammer "N/A", two days later on the 27th we all decided to resign. Soon after this point "N/A" presumably realized that he cannot run a forum without moderators, thus leading him to try and attempt to sell the forum once again.
That is why some long-time members, in collaboration with the former moderation team decided to take action. We subsequently launched PwnForums an independent forum with no ties to the former BreachForums administration, created in collaboration with the BreachForums moderation team and some long-time members.
PwnForums migrated accounts, ranks and credits from multiple forums before. Can you explain exactly which data PwnForums received and where it came from?
We launched PwnForums on April 5 2026, and the PwnForums administration was able to retrieve the entire database as of March 28, 2026 (including threads, posts, and users). All of this information came from the BreachForums.
Was PwnForums planned before that incident, or was it created directly because of it?
We hadn't planned on creating PwnForums before the various incidents involving the former administrators but we felt it was necessary in the community's best interest to do so in order to protect it and ensure it had a safe forum (unlike all the clones/honeypots out there)
What does a forum like yours actually look like from the inside? What would a new member see when logging in for the first time?
A new member logging in for the first time would see the shout-box as well as the various sections. Given the sheer size of the forum and the amount of content available in the different sections the user wouldn't have time to get bored.
Who uses PwnForums? Are most members hackers, data sellers, researchers, curious observers, or something else?
We don't have any internal statistics. So it would be difficult to say for sure it's probably a mix of all of those factors.
People can already communicate through Telegram, Discord and other messaging platforms. Why are traditional forums still needed?
We don’t claim because it’s not the case anyway that PwnForums is a messaging platforms. PwnForums is a forum like many others where people come to find what they need for a specific purpose.
However we believe forums are still necessary for communication because messaging platforms pose major OPSEC and centralization issues (such as Telegram and Discord) and hold a vast amount of metadata on their users which is not the case on PwnForums.
What does running a forum of this size involve on a normal day?
A lot of kibble and some cat toys.
A large part of the forum concerns leaked databases. When someone claims to have a company’s database, what information can it contain? Could you give a simple example of what one row inside such a database might look like?
A company database contains all the information that companies may have about you it is quite diverse but consists mainly of PII (first and last names, e-mail and mailing addresses, phone numbers and IP addresses)
For those who are interested our CDN is an excellent way to answer your question with over 1,211 databases.
What happens to stolen data after it is posted on a forum? Who wants it, and what can they do with it?
Once stolen data is posted on a forum it is downloaded by users who have various reasons for doing so. We cannot (for obvious reasons) guess what users do with the databases. But generally speaking, this allows some to use them for phishing, while others use them to index the databases. Everyone’s motives are personal.
Do you verify breach claims before they appear on the forum?
It wouldn't be realistic to manually submit EVERY new thread posted in the Leaks section for approval so no but the forum is actively moderated which generally allows us to identify and remove fake leaks.
That said it’s worth noting that the rules in the Marketplace sections are stricter and that these sections are generally moderated more rigorously.
How can users know that the transferred database was not modified, copied by others or already accessed by law enforcement?
It is impossible to guarantee the authenticity of the data disclosed once it has left the forum as it may have been altered therefore everyone must take the necessary steps to verify this data using various tools.
Cybercrime forums are themselves frequently hacked. BreachForums previously exposed usernames, email addresses, IP addresses and private messages. What information does PwnForums collect about its own users?
The information we retain includes email addresses and IP addresses. Please note that IP addresses and private messages are deleted after a certain period of time to ensure the best possible security for our users.
Does PwnForums provide an escrow service? If so, could you explain how escrow works using a simple example?
PwnForums offers a semi-automated escrow service. The PwnForums escrow service is designed to facilitate secure transactions on the forum.
We offer a service that protects both parties the buyer and the seller from the consequences of a breach of contract. On the dark web everyone is anonymous without adequate protection the risk of fraud from both the seller and the buyer is therefore high.
Here’s how our process works: you start by creating a transaction indicating whether you are the seller or the buyer and then filling in the necessary information. Next the buyer deposits funds into a unique deposit address provided by the platform. Once confirmation is received the seller can then proceed with the transaction by delivering the product or providing the service. Only once the seller has fulfilled their contractual obligations can the buyer finalize the transaction.
If the product or service is not provided as promised, a dispute resolution process is initiated. During this process an impartial mediator will evaluate the circumstances and evidence to reach a resolution.
Some forums ban ransomware while allowing data trading and other forms of cybercrime. What activities does PwnForums allow, and where do you draw the line?
We allow a wide range of activities but all Blackhat activities remain prohibited. This includes in particular drug sales, weapon sales, violence-as-a-service.
Are there categories of victims or data that cannot be targeted or posted, such as hospitals, children or critical infrastructure?
With regard to Ransomware-as-a-Service which is permitted on the forum certain rules have been established such as a complete ban on data related to health and children.
Every new forum is accused of being either a scam or a law enforcement honeypot. How do you convince users that PwnForums is neither?
We don't need to convince people. People need to be able to understand what a honeypot is and what isn't one.
If PwnForums were seized tomorrow, what would happen to its database and private messages?
In the most extreme case such as the arrest of several administrators we will take the necessary steps to ensure that the database is completely erased. Private messages are automatically deleted after a certain amount of time, and they will be deleted as well.
Thank you for joining us. Is there anything else you would like our listeners and readers to know?
The PwnForums team would like to thank you for your time, as well as your listeners for reading and/or listening to us. We look forward to seeing many of you on PwnForums.