A Kosovar national has pleaded guilty to operating Rydox, a large illegal online marketplace that sold stolen personal information, login credentials, credit card details, and cybercrime tools.
Kosovo law enforcement and Albania’s Special Anti-Corruption Body (SPAK) arrested 28-year-old Ardit Kutleshi and two other Rydox administrators (Jetmir Kutleshi and Shpend Sokoli) in December 2024.
The arrests were part of a joint international law enforcement operation that also shut down the Rydox marketplace, seized the Rydox[.]cc domain, and seized its servers in Kuala Lumpur with the help of the Royal Malaysian Police.
Ardit Kutleshi was extradited from Kosovo to the United States in 2025, when he was charged with crimes related to their Rydox admin role, including conspiracy to commit identity theft, aggravated identity theft, two counts of identity theft, access device fraud, and money laundering.
“Rydox put cybercriminal tools and sensitive data up for sale, including the stolen identities and logins of thousands of people,” said Brett Leatherman, assistant director of the FBI’s Cyber Division. “The FBI and its foreign partners shut the marketplace down, and now the man who created it and ran it pleaded guilty.”
According to court documents, between February 2016 and Rydox’s shutdown in 2024, marketplace sellers were involved in over 7,600 sales of login credentials, credit card information, and stolen personal information (including Social Security numbers, names, and addresses) of thousands of U.S. citizens.
Rydox also offered over 321,000 other “cybercrime products” for sale to more than 18,000 users, including various devices, software tools, and materials for committing cybercrimes.
Rydox users had to deposit cryptocurrency into their accounts before making a purchase via Bitcoin (“BTC”), Monero, Ripple, Ethereum, Litecoin, Perfect Money, Tron, or Verge payments that were deposited into a Rydox-controlled cryptocurrency wallet and could be used to buy illicit products, services, tools, and programs from Rydox sellers.
The marketplace also charged registered users a one-time fee (that fluctuated between $200 and $500) to become authorized sellers, who received 60% of the sale proceeds, while the marketplace retained 40% from every sale.
Kutleshi has pleaded guilty to aggravated identity theft and money laundering conspiracy and is scheduled to be sentenced on February 9, 2027.
He now faces a maximum penalty of 20 years in prison for money laundering and a minimum penalty of two years in prison for the aggravated identity theft count.
Since the start of the year, the owner of the Incognito dark web drugs market was sentenced to 30 years in prison in February, while a California man who sold fentanyl and methamphetamine on the Nemesis dark web marketplace was sentenced to more than 26 years in federal prison.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
