- A hacker named “mrwho” claims to sell the full source code and database of bf.st, a forum tied to BreachForums.
- The seller says the stolen package holds about 128 database tables and wants payment in Monero.
- Reports confirm the claim exists online, but no one has proven the files are real yet.
A hacker is trying to sell what they call the complete backend of bf.st. This forum carries strong ties to BreachForums, a well-known hub for stolen data.
The seller goes by the alias “mrwho” and posted the offer on a separate cybercrime site called PwnForums. If the claim holds up, the sale could expose forum members and reveal how the platform actually works behind the scenes.
A Known Underground Forum Comes Under Fire
Cybersecurity monitoring account VECERT Analyzer flagged the listing on September 16, 2026. According to the alert, mrwho claims to have broken into bf.st sometime in late May or early June 2026.
That period lines up with the forum’s launch window, according to the same alert. The seller reportedly says the stolen package includes bf.st’s entire source code. It also allegedly includes the platform’s full SQL database.
A separate report from Undercode News picked up the story after the VECERT post went out. That report adds more detail to the seller’s claims. Mrwho reportedly says the database contains close to 128 separate tables. The seller also wants buyers to pay in Monero, a privacy-focused cryptocurrency. Criminals often prefer Monero because it makes transactions harder to trace.
Bf.st itself is not a mystery site invented for this story. Public posts on the forum confirm it carries BreachForums branding and history. One such post from 2024 shows a user known as IntelBroker discussing changes to the forum’s banner and profile pictures.
That post proves bf.st exists and has real ties to the wider BreachForums community. It does not, however, prove that mrwho’s newer claims about a breach are true.
Doubts Remain Over the Stolen Files
The central question still has no clear answer. Did mrwho actually steal bf.st’s source code and database, or not? Underground marketplaces host plenty of fake or recycled listings. Sellers sometimes exaggerate what they have to attract buyers faster. A confident sales pitch is not the same as solid proof.
The Undercode News report makes this point directly. It states that the listing alone does not prove the files are genuine. The report also notes that no one has confirmed whether the data is complete. Nobody has verified that mrwho actually obtained it through a real hack, either. Right now, this remains an unconfirmed claim rather than a proven security incident.
Verifying a claim like this takes real technical work. Researchers would need to test the leaked files against bf.st’s actual systems. They would compare database structures and match records to real forum activity.
They would also need to check how old the material is. Investigators must determine whether the source code truly matches bf.st’s live, working environment. Until that work happens, treat the claim as unproven.
The Risks If the Leak Turns Out Real
A genuine breach here could still carry serious weight, even without full confirmation yet. A stolen database often holds account details and password hashes. Members who reused old passwords elsewhere could face fresh account takeover attempts. Leaked source code could also reveal exactly how bf.st manages logins. It could expose how the platform stores data and runs administrative tools.
Source code has also become a valuable target in other cybercrime listings. In a separate case, hackers claimed to have stolen and put GamingSoft’s source code up for sale for $125,000, showing how valuable proprietary code can become on underground markets.
The VECERT alert specifically points to IP address records as valuable if the leak is real. It also references private messages and cryptocurrency invoice data tied to user activity. Those details would matter most to researchers and investigators tracking criminal activity. For now, treat all of that as claims about the database’s contents. None of it counts as confirmed, verified information at this stage.
Breaches like this can carry real intelligence value beyond the forum itself. Data from criminal platforms sometimes helps researchers link anonymous usernames to real financial activity. Law enforcement teams can use that kind of information during ongoing investigations.
That value only exists, though, if the leaked material proves authentic first. Claims tied to criminal forums always need careful, patient verification before anyone treats them as fact.
The most accurate summary right now stays fairly simple. A threat actor claims to hold and sell bf.st’s source code and full database. Reporting confirms that this claim exists and has spread across cybercrime circles.
That reporting does not confirm the theft happened exactly as mrwho describes it. Until researchers examine the actual files, this remains a developing claim. It has not yet become a fully confirmed security compromise.
Anyone connected to bf.st or similar forums should still stay alert regardless. Watching for unusual account activity costs nothing and adds a layer of safety. Changing reused passwords remains smart advice, whether or not this specific claim proves true. Cybercrime forums face breaches often, and today’s rumor sometimes becomes tomorrow’s confirmed headline.
