Rydox founder Ardit Kutleshi pleads guilty over a stolen-data market that took in $232,000

Ardit Kutleshi, 28, a citizen of Kosovo, pleaded guilty to building and running the cybercrime marketplace Rydox.

Kutleshi pleaded guilty in the District Court for the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy.

Rydox was disrupted in December 2024, when the US obtained judicial authorization to seize www.Rydox.cc, the domain that hosted the marketplace.

Kosovo law enforcement and Albania's Special Anti-Corruption Body (SPAK) arrested Ardit Kutleshi and two other Rydox administrators, Jetmir Kutleshi and Shpend Sokoli, in December 2024.

At least 321,372 cybercrime products were allegedly offered on Rydox, including names, addresses, credentials, credit cards and Social Security numbers, along with phishing kits, stealer logs and spamming tools.

Rydox was estimated to have had approximately 18,000 users when taken down.

Rydox users had to deposit cryptocurrency (Bitcoin, Monero, Ripple, Ethereum, Litecoin, Perfect Money, Tron or Verge) into a Rydox-controlled wallet before making a purchase.

The marketplace charged registered users a one-time fee of $200 to $500 to become authorized sellers; sellers received 60% of sale proceeds and the marketplace retained 40%.

Ardit Kutleshi was extradited to the US in 2025.

Kutleshi faces two years of mandatory prison for aggravated identity theft and up to 20 years in prison for money laundering.

Kutleshi is scheduled to be sentenced on February 9, 2027.

Rydox operated between February 2016 and its shutdown in 2024.

Jetmir Kutleshi, Ardit's brother, also helped operate the marketplace; he pleaded guilty separately and was sentenced in December 2025 before being deported to Kosovo.

"Rydox put cybercriminal tools and sensitive data up for sale, including the stolen identities and logins of thousands of people," said Brett Leatherman, assistant director of the FBI's Cyber Division.

"These types of cybercrimes cause not only financial loss, but also ongoing psychological harm to the victims who lose both money as well as trust in institutions and the online market infrastructure," said U.S. Attorney Troy Rivetti of the Western District of Pennsylvania.

Rydox's operators took about $30.50 per transaction.

Over roughly 8.8 years of operation, Rydox's revenue averaged about $26,000 a year.

If the $232,000 is only the market's 40% cut, gross sales were about $580,000, or roughly $76 per transaction.

Security Affairs writes that identity theft is not a one-time event; it follows people through credit checks, background checks and account recovery processes for years.

Security Affairs writes that Kutleshi's extradition from Kosovo shows that operating outside the United States does not necessarily protect cybercriminals from US prosecution.

The Justice Department's Criminal Division said that since 2020 its Computer Crime and Intellectual Property Section has secured convictions against more than 180 cyber and intellectual property criminals, and courts have ordered the return of more than $350 million to victims.

This year the owner of the Incognito dark web drugs market was sentenced to 30 years in prison in February, and a California man who sold fentanyl and methamphetamine on the Nemesis dark web marketplace was sentenced to more than 26 years.

Rydox's 7,600 sales equal about 2.4% of the 321,372 products offered.

Rydox recorded fewer than one purchase for every two user accounts.

The roughly $225,000 in seized cryptocurrency equals about 97% of Rydox's reported lifetime revenue.