The purpose of a blacklist is multifold - to reduce the efficiency of an offline attack, in which the hashes are stolen and can be attacked at high speeds without rate limiting - as well as an online attack.
Maybe salt your passwords, use some stretches, and a decent algorithm instead of MD5, SHA1, etc.
Also stay up on algorithms and roll your users over to new ones over time.