Rydox Co-Founder Pleads Guilty After International Cybercrime Takedown
A Kosovar national has pleaded guilty in the United States to operating Rydox, an illicit online marketplace that spent nearly a decade supplying cybercriminals with stolen identities, compromised credentials and tools used to conduct fraud.
Ardit Kutleshi, 28, pleaded guilty in federal court in Pennsylvania to aggravated identity theft and conspiracy to commit money laundering.
The plea marks another major step in an international investigation that dismantled Rydox in December 2024 and involved authorities in the United States, Kosovo, Albania and Malaysia.
Kutleshi is scheduled to be sentenced on February 9, 2027.
Rydox Built a Marketplace Around Stolen Identities
Rydox operated from at least 2016 until its shutdown in 2024, providing an online trading platform where criminals could buy and sell stolen personal information, access devices and fraud-related services.
Thousands of Illicit Transactions Passed Through the Platform
According to U.S. court documents, Rydox facilitated more than 7,600 transactions and generated at least $232,000 in revenue.
Products sold through the marketplace included personally identifiable information belonging to U.S. victims, compromised login credentials, payment-card information and other data that could facilitate identity theft and financial fraud.
Independent reporting indicates that the marketplace accumulated approximately 18,000 registered users during its operation.
Sellers Paid for Access to the Criminal Economy
Rydox operated more like a commercial platform than an informal hacking forum.
Authorized sellers reportedly paid a one-time registration fee ranging between $200 and $500.
Marketplace vendors received approximately 60% of each transaction, while Rydox retained the remaining 40%, giving its administrators a direct financial incentive to increase criminal sales.
Kutleshi Helped Build and Operate the Platform
Federal prosecutors identify Kutleshi as one of the individuals responsible for creating and operating Rydox.
His brother, Jetmir Kutleshi, was also implicated in the operation.
Brother Was Previously Convicted and Deported
Jetmir Kutleshi previously pleaded guilty in the United States and was sentenced in December 2025 before being deported to Kosovo.
U.S. prosecutors say the brothers earned hundreds of thousands of dollars through the marketplace and its associated criminal activity.
International Operation Dismantled Rydox Infrastructure
The prosecution followed a coordinated law-enforcement operation launched against the marketplace in December 2024.
U.S. Authorities Seized the Main Domain
The United States judicially seized Rydox.cc, preventing administrators and customers from continuing to use the primary domain to trade stolen information and cybercrime services.
Taking control of the domain effectively removed one of the marketplace's central access points.
Malaysian Authorities Seized Supporting Servers
The operation extended beyond the website itself.
Malaysia's Royal Police assisted investigators by seizing servers used to support Rydox, while authorities in Kosovo and Albania targeted individuals connected to the platform.
Kutleshi was arrested by Kosovo law enforcement in December 2024 and subsequently extradited to the United States in 2025.
Guilty Plea Carries Significant Prison Exposure
Kutleshi pleaded guilty on September 22 to two federal offenses.
Identity-Theft Conviction Carries Mandatory Prison Time
The aggravated identity theft count carries a mandatory minimum sentence of two years in federal prison.
The money-laundering conspiracy charge carries a maximum sentence of 20 years.
The final punishment has not yet been determined. A federal judge will consider U.S. Sentencing Guidelines and other statutory factors at sentencing.
Rydox Demonstrates the Commercialization of Cyber Fraud
The significance of Rydox extends beyond the stolen records traded through the site.
Criminal Platforms Lower the Barrier to Entry
Marketplaces such as Rydox allow criminals to purchase components of an attack instead of obtaining them independently.
A fraudster may not need to compromise a victim directly when credentials, identities, access information and supporting tools can simply be purchased from another criminal.
This division of labor lowers the technical barrier for conducting fraud and allows specialists in data theft, credential harvesting and social engineering to monetize their capabilities separately.
Infrastructure Takedowns Must Target More Than Domains
The Rydox operation also demonstrates why modern cybercrime investigations increasingly combine arrests, extraditions, domain seizures, server confiscation and financial investigations.
Removing a website alone may not dismantle the people, infrastructure or money flows behind it.
By coordinating across multiple jurisdictions, investigators targeted both Rydox's technical infrastructure and the individuals accused of operating the marketplace.
The case illustrates a defining feature of today's cybercrime economy: stolen identities are no longer merely the output of individual breaches. They have become commodities moving through specialized marketplaces that connect data thieves, access sellers and fraud operators into a broader criminal supply chain.