Young man from Kosovo pleads guilty in US to operating illegal online marketplace Rydox

A 28-year-old Kosovo citizen, Ardit Kutleshi, has pleaded guilty in U.S. court to charges filed against him in connection with founding and operating Rydox, an illegal virtual marketplace where cybercriminals traded stolen personal data and tools for committing fraud.

According to the U.S. Department of Justice announcement, Kutleshi appeared in the U.S. District Court for the Western District of Pennsylvania, where he pleaded guilty to aggravated identity theft and involvement in a money laundering conspiracy.

U.S. investigators found that the Rydox platform had been active at least since 2016, brokering more than 7,600 transactions involving stolen personal data, access credentials, identification documents, as well as tools and services dedicated to online criminal activity.

Case documents show that this criminal activity generated no less than $232,000 in revenue.

“Ardit Kutleshi’s guilty plea for operating the Rydox marketplace sheds light on a sophisticated scheme aimed at profiting from stolen identities and cybercrime tools,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.

He stressed that this case proves the determination of U.S. authorities to identify and prosecute cybercriminals, no matter where they are located, thanks to international partnership and the use of the latest technologies.

U.S. Attorney Troy Rivetti stated that Ardit Kutleshi and his brother, Jetmir Kutleshi, had operated Rydox for personal gain, earning hundreds of thousands of dollars from a platform specializing in the sale of information and tools for committing cybercrimes.

His brother, Jetmir Kutleshi, had previously pleaded guilty and was sentenced in December 2025, before being repatriated to Kosovo.

FBI Cyber Division Assistant Director Brett Leatherman said that highly sensitive data had been offered for sale through Rydox, including identities and account access information belonging to thousands of citizens.

“The FBI and its international allies shut down the marketplace, and now the person who conceived and operated it has accepted responsibility,” Leatherman stressed.

Kutleshi was arrested by Kosovo authorities in December 2024 and extradited to the United States during 2025.

In the same month, December 2024, U.S. authorities seized the domain Rydox.cc, thereby blocking the platform’s continued trade in personal data and cybercrime tools.

Kutleshi’s sentencing hearing is scheduled for February 9, 2027.

For aggravated identity theft, the law provides a mandatory minimum sentence of two years in prison, while for the money laundering conspiracy charge, the maximum sentence can reach up to 20 years in prison.

The final sentencing decision will be made by a federal magistrate, who will consider the relevant U.S. sentencing guidelines and other legal circumstances of the case.

The investigation was conducted by the FBI’s Pittsburgh field office, in coordination with the Kosovo Special Prosecution Office, the Cybercrime Investigation Directorate within the Kosovo Police, the SPAK Special Prosecution Office in Albania, the Royal Malaysia Police, and Malaysian judicial authorities.

The U.S. Department of Justice also announced that, since 2020, the Computer Crime and Intellectual Property Section has secured the conviction of more than 180 individuals for cybercrime and intellectual property violations, and has obtained court orders restoring over $350 million to victims’ funds.