Rydox marketplace operator pleads guilty in US court

Ardit Kutleshi, one of the men accused of running the Rydox cybercrime marketplace, has pleaded guilty in the United States to aggravated identity theft and money laundering.

The 28-year-old was extradited from his home country of Kosovo last year. US prosecutors say he and his older brother ran Rydox, an illicit platform where cybercriminals bought stolen personal information, unauthorized access to devices and other tools used to commit fraud.

Sentencing is set for February. The aggravated identity theft charge carries a mandatory minimum of two years in prison. The money laundering count carries a maximum of 20 years.

A shop for stolen identities and fraud kits

According to prosecutors, Kutleshi helped operate Rydox for nearly a decade. During that time the site processed more than 7,600 transactions, which brought in $232,000.

The marketplace had around 18,000 users. They could buy Social Security numbers, the US identifier tied to employment, taxes and credit, along with manuals explaining how to build scam pages and other products. That mix of stolen data and practical guides meant buyers got both the raw material for fraud and instructions on how to use it.

Rydox was not open to anyone who simply showed up. Users had to deposit money with the site before they were approved to buy anything listed on the platform. The requirement likely served to filter out casual visitors and made sure buyers had already committed funds before they could access the goods.

U.S. Attorney Troy Rivetti said the brothers made "hundreds of thousands of dollars from the marketplace where cybercriminals could purchase information and tools to effect and further their online crime."

Rivetti also addressed the harm to victims beyond the money they lose.

"These types of cybercrimes cause not only financial loss, but also ongoing psychological harm to the victims who lose both money as well as trust in institutions and the online market infrastructure," he said.

Brett Leatherman, Assistant Director of the FBI's Cyber Division, said the platform gave anyone access to large collections of stolen identities and login details belonging to thousands of people.

A takedown spanning four countries

The action against Rydox goes back to December 2024. That month, the FBI and other law enforcement agencies seized the domain that hosted the marketplace. At the same time, Kosovo police arrested Kutleshi.

The operation was not limited to the US and Kosovo. Law enforcement in Albania arrested another person involved in running Rydox, and police in Malaysia seized several servers used to operate the site.

The coordinated approach targeted the platform from several directions at once: the domain users relied on to reach the site, the people who ran it, and the servers that kept it online.

Brother sentenced and deported

Kutleshi's older brother had already pleaded guilty before him. Rivetti said the brother was sentenced to time served and then deported back to Kosovo in December.

Whether Ardit Kutleshi will follow the same path remains unclear. Recorded Future News asked whether he would also be deported. A Justice Department spokesperson pointed the outlet to the Department of Homeland Security, the US agency that oversees immigration enforcement. DHS did not respond to requests for comment.

The Justice Department also did not say whether Kutleshi is still in its custody.

Our Take

The Rydox case shows how small the numbers behind a long-running criminal marketplace can look on paper. $232,000 from more than 7,600 transactions works out to modest sums per sale. The real cost is carried by the people whose Social Security numbers and logins were resold, and by those later targeted with the scam pages that buyers learned to build. Rivetti's comments about lost trust point to exactly that downstream damage.

The case also fits a steady pattern of US prosecutors pursuing cybercrime suspects abroad through extradition and joint operations, a trend also visible in cases such as the charges against Oxygen Forensics executives. Seizing the domain, arresting operators and taking servers at the same time suggests an effort to make it harder for the platform to simply reappear elsewhere.

For defenders, the lesson is a familiar one. Personal data taken in breaches and phone-based scams often ends up for sale on sites like this one, where it fuels further fraud.

It is worth watching what sentence Kutleshi receives in February, and whether he, like his brother, is ultimately sent back to Kosovo. The outcome could indicate how US courts weigh time already spent in custody in extradition cases of this kind.