OLVX cybercrime market admin arrested in North Macedonia

Police in North Macedonia have arrested the man believed to be the administrator of OLVX, an underground marketplace where criminals traded stolen personal data, login credentials and hacking tools. The arrest was carried out this week as part of a joint operation between the country's Ministry of Interior and the FBI.

Authorities did not release the suspect's name. According to the FBI and North Macedonian officials, charges were filed first, and officers then raided the man's home in the village of Golema Rečica.

A marketplace with 1,500+ seller accounts

OLVX first appeared in 2023 and quickly became a well-used destination for cybercriminals looking to buy or sell data and tools. The FBI said the market operated until 2025.

"Active between 2023 and 2025, OLVX is alleged to have unlawfully sold victims' personally identifiable information and login credentials via over 1,500 seller accounts," the FBI said in a statement.

The bureau also stressed the impact on US victims: "The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use."

Cybersecurity firm ZeroFox looked closely at OLVX in a detailed report published in 2023. At the time, it warned that the site was growing in popularity among sellers of phishing kits, remote desktop connections, credentials, stolen data and other criminal tools.

No escrow, just crypto balances

One detail set OLVX apart from many of its competitors. Plenty of underground markets run an escrow service, where the platform holds a buyer's payment until the deal is complete. OLVX did not.

Instead, users loaded cryptocurrency onto the site and used those funds to pay each other directly. Money moved between buyers and sellers through balances held on the platform itself.

Telegram side business and CSAM allegations

The case extends beyond OLVX. North Macedonian police said the suspect also ran a Telegram group called ONEMILI. That group offered tools for fraudulent refund schemes, where criminals trick retailers into issuing refunds they are not owed, as well as other types of scams.

Investigators also say they found something far more serious during the probe.

"Additionally, evidence was obtained indicating that the suspect had acquired and possessed child sexual abuse material (CSAM) for personal use through the Telegram application," North Macedonia's Interior Ministry said.

Part of a wider crackdown

The arrest fits into a long run of actions against criminal marketplaces. Over the past five years, law enforcement agencies have taken down dozens of these sites, which have become central hubs where hackers swap stolen data, tools and techniques.

Other recent cases point in the same direction. Last week, a co-creator of the dark web forum Empire Market received a 40-year federal prison sentence in the US.

The private sector has been active too. On Wednesday, Microsoft said it had taken down three Chinese phishing platforms that cybercriminals used to send hundreds of millions of malicious messages. Those messages impersonated more than 75,000 organizations around the world.

Our Take

OLVX was not the largest or most famous underground market, but this arrest shows that mid-sized players are not out of reach. The FBI teamed up with a small Balkan country to reach an administrator working from a village. This suggests that a modest location offers little protection once investigators connect an operator to a platform.

For defenders, the takeaway is less comforting. OLVX was active for about two years and hosted more than 1,500 seller accounts. Credentials and personal data sold during that time are probably still circulating, and buyers rarely vanish when one market closes. Organizations should still treat stolen logins as an ongoing risk and rely on strong authentication and credential monitoring.

It is worth watching whether the FBI tries to have the suspect extradited, and whether data seized from the platform leads to cases against OLVX sellers or buyers. Seized marketplace records have often fed later investigations, and that could happen here too.