Ardit Kutleshi, a 28-year-old Kosovo national, pleaded guilty this week to aggravated identity theft and money laundering in connection with his role operating Rydox, an illicit online marketplace. He was extradited from Kosovo last year and is scheduled to be sentenced in February, facing a mandatory minimum of two years and up to 20 years on the money laundering count.
According to U.S. prosecutors, Rydox operated for nearly a decade, allowing cybercriminals to buy stolen personal data, device access, and fraud guides. The site processed more than 7,600 transactions, bringing in roughly $232,000, and had about 18,000 users who could make purchases after depositing funds. The FBI's assistant director for cyber noted the platform gave buyers access to large troves of stolen identities and login credentials.
The case involved international coordination: Kosovo law enforcement arrested Kutleshi in December 2024, when the Rydox domain was seized. Authorities in Albania arrested another person linked to the marketplace, and Malaysian police seized servers used to run it. Kutleshi's older brother previously pleaded guilty and was sentenced to time served before being deported to Kosovo in December.
U.S. Attorney Troy Rivetti said the brothers made hundreds of thousands of dollars from the marketplace, and he emphasized the broader harm of such crimes, including financial loss and psychological damage to victims. The Justice Department did not say whether Kutleshi remains in custody, and his possible deportation is unresolved; a DHS spokesperson did not respond to requests for comment.