Between February 2016 and Rydox's shutdown in 2024, marketplace sellers were involved in over 7,600 sales of login credentials, credit card information, and stolen personal information — including Social Security numbers, names, and addresses — of thousands of U.S. citizens.
The guilty plea and charges against Ardit Kutleshi
Ardit Kutleshi, a 28-year-old Kosovar national, has pleaded guilty to operating Rydox, a large illegal online marketplace that trafficked in stolen personal information, login credentials, credit card details, and cybercrime tools. Prosecutors charged Kutleshi after his extradition from Kosovo to the United States in 2025. The superseding indictment filed in the U.S. charged him with multiple offenses, including conspiracy to commit identity theft, aggravated identity theft, two counts of identity theft, access device fraud, and money laundering. In his plea, Kutleshi admitted to aggravated identity theft and to a conspiracy to commit money laundering. He is scheduled to be sentenced on February 9, 2027.
Scale of Rydox's offerings: stolen data, credentials, and cybercrime tools
Court filings and law enforcement statements describe Rydox as a broad marketplace for illicit products. Between 2016 and the marketplace's 2024 closure, sellers on Rydox completed more than 7,600 sales of login credentials, credit card information, and stolen personal information tied to thousands of U.S. citizens. The site also listed over 321,000 additional “cybercrime products” — a category that, according to the records, encompassed devices, software tools, and materials for committing cybercrimes — available to more than 18,000 registered users. That scale places Rydox among the larger illicit markets documented in the public record of this case.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildInternational takedown: Kosovo, SPAK, Malaysia, and the FBI
The disruption of Rydox was the result of a joint international law enforcement operation. Kosovo authorities and Albania’s Special Anti-Corruption Body (SPAK) arrested Ardit Kutleshi along with two other Rydox administrators, Jetmir Kutleshi and Shpend Sokoli, in December 2024. The operation also seized the Rydox[.]cc domain and the marketplace’s servers in Kuala Lumpur with assistance from the Royal Malaysian Police. Following his arrest in Kosovo, Ardit Kutleshi was extradited to the United States in 2025 to face federal charges. “Rydox put cybercriminal tools and sensitive data up for sale, including the stolen identities and logins of thousands of people,” said Brett Leatherman, assistant director of the FBI’s Cyber Division. “The FBI and its foreign partners shut the marketplace down, and now the man who created it and ran it pleaded guilty.”
How the marketplace economy worked: fees, revenue splits, and cryptocurrency
Rydox required users to deposit cryptocurrency into accounts before making purchases. Payment methods accepted included Bitcoin (BTC), Monero, Ripple, Ethereum, Litecoin, Perfect Money, Tron, and Verge; funds were deposited into a Rydox-controlled cryptocurrency wallet and were used to buy illicit goods and services from sellers. The marketplace also charged a one-time authorization fee for seller accounts that fluctuated between $200 and $500. Once authorized, sellers received 60% of sale proceeds while the marketplace retained 40% of every sale, a revenue split specified in the case materials.
What this means for U.S. victims, international law enforcement, and dark web operators
- U.S. victims: The court record ties the sale of Social Security numbers, names, addresses, login credentials, and credit card data to thousands of U.S. citizens. Those individuals are identifiable in the charging documents only by the types of information sold; the guilty plea confirms the marketplace’s role in trafficking that data.
- International law enforcement partners: Kosovo law enforcement, Albania’s SPAK, and the Royal Malaysian Police worked with U.S. authorities to seize a domain and physical servers and to secure arrests and an extradition. The case underscores the transnational dimensions of taking down a large illicit marketplace and the operational steps used — domain seizure, server seizure, and extradition — as recorded in the public materials.
- Dark web marketplace operators: The plea and the associated sentences referenced in the reporting sit alongside recent, steep penalties for operators of other illicit markets. Since the start of the year, the owner of the Incognito dark web drugs market was sentenced to 30 years in prison in February, and a California man who sold fentanyl and methamphetamine on the Nemesis dark web marketplace was sentenced to more than 26 years in federal prison — outcomes noted in the same reporting.
Kutleshi faces a statutory maximum of 20 years in prison for the money laundering conspiracy count and a mandatory minimum of two years in prison for the aggravated identity theft conviction; his sentence will be set on February 9, 2027. The Rydox disruption — arrests, domain and server seizures, extradition, and guilty pleas — is now part of the public record in a case that ties significant volumes of stolen U.S. personal data and crypto-fueled marketplace mechanics to a coordinated international enforcement effort.
Source: BleepingComputer — Rydox marketplace admin pleads guilty, faces 22 years in prison
