28-year-old from Kosovo pleads guilty in the US over Rydox cyber platform

Ardit Kutleshi, a 28-year-old from Kosovo, has pleaded guilty before U.S. authorities for his role in founding and administering Rydox, an internet platform specializing in the sale of stolen personal information and tools for committing cybercrimes.

The announcement was made by the U.S. Department of Justice, and the case also drew attention on social media through the FBI Cyber Division, which underlined that Rydox had placed on the market highly sensitive data and stolen identities belonging to thousands of citizens.

According to court materials, the Rydox platform had been operating at least since 2016 and during that period had carried out more than 7,600 transactions, collecting income of no less than $232,000.

On this virtual marketplace, personal data, login credentials for various accounts and tools that could be used for online fraud were offered.

Kutleshi was convicted of aggravated identity theft and participation in a money laundering conspiracy. He was detained by law enforcement in Kosovo in December 2024 and during 2025 was handed over to U.S. authorities through extradition.

Brett Leatherman, assistant director of the FBI’s Cyber Division, stressed that Rydox had made available tools for cybercrime and sensitive information, including identities and login data of thousands of people.

Meanwhile, U.S. prosecutor Troy Rivetti stated that Ardit Kutleshi and his brother, Jetmir Kutleshi, had run the platform for financial gain. Jetmir had pleaded guilty and was sentenced in December 2025 before being forcibly sent back to Kosovo.

Rivetti added that such cyber offenses cause not only material damage, but also leave consequences for the mental health of victims.

American officers had blocked the Rydox domain in December 2024, putting an end to the platform’s activity. The investigations were carried out in close coordination between the FBI and the relevant institutions of Kosovo, Albania and Malaysia.

The sentencing hearing for Kutleshi is scheduled for February 9, 2027. For aggravated identity theft, the law provides for a mandatory minimum of two years in prison, while for money laundering conspiracy the maximum sentence can reach up to 20 years of imprisonment.

The final decision on sentencing will be made by the federal court.