PITTSBURGH — Ardit Kutleshi pleaded guilty in the District Court for the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy. The 28-year-old Kosovar national admitted to charges related to the creation and operation of Rydox, an illicit website and marketplace for cybercriminals to buy, sell, and trade stolen personal information, access devices, and tools for carrying out cybercrime and fraud.

Since at least 2016, Rydox conducted over 7,600 transactions involving stolen personally identifiable information, stolen access devices, means of identification, and cybercrime tools and services. The marketplace received at least $232,000 in revenue from these transactions, which involved the sale of personally identifiable information stolen from victims located in the United States.

Assistant Attorney General A. Tysen Duva said the guilty plea of Kutleshi for operating the Rydox marketplace exposes a sophisticated scheme to profit from stolen identities and cybercrime tools. FBI Assistant Director Brett Leatherman said "Rydox put cybercriminal tools and sensitive data up for sale, including the stolen identities and logins of thousands of people." A. Duva said this guilty plea sends a strong message to all cybercriminals that the Justice Department will identify, arrest, and prosecute cybercriminals regardless of where they are in the world through international cooperation, technical expertise, and cutting-edge law enforcement. Leatherman said the FBI and its foreign partners shut the marketplace down, and now the man who created it and ran it pleaded guilty.

Kutleshi was arrested by Kosovo law enforcement in December 2024. The United States judicially seized the domain www.Rydox.cc in December 2024, which hosted and facilitated access to the Rydox website. The seizure prevented the owners and third parties from using the site to continue to buy and sell cybercrime tools and stolen personal identifying information of U.S. citizens.

Kutleshi was extradited from Kosovo to the United States in 2025. He faces a mandatory minimum penalty of two years in prison for the aggravated identity theft count. He also faces a maximum penalty of 20 years in prison for the money laundering conspiracy count. Kutleshi is scheduled to be sentenced on Feb. 9, 2027.

U.S. Attorney Troy Rivetti noted that Kutleshi and his brother Jetmir operated the marketplace for their own gain. Rivetti said these types of cybercrimes cause not only financial loss, but also ongoing psychological harm to the victims who lose both money as well as trust in institutions and the online market infrastructure. He said his office will continue to work with law enforcement partners to find and prosecute individuals who attempt to profit from the illegal sharing and sale of other people’s personal information and access devices, and related cybercrime. Rivetti said cybercriminals Kutleshi and his brother Jetmir operated the Rydox marketplace for their own gain, making hundreds of thousands of dollars from the marketplace where cyber criminals could purchase information and tools to effect and further their online crime.

The FBI’s Pittsburgh Field Office investigated this case in coordination with the Kosovo State Prosecutor’s Special Prosecution Office, the Kosovo Police’s Cybercrime Investigation Directorate, the Albanian Special Anti-Corruption Body (SPAK), the Royal Malaysia Police’s Commercial Crime Investigation Department, and the Attorney General’s Chambers of Malaysia. Leatherman said the FBI will continue to use every legal tool at its disposal to extradite cybercriminals and take down their infrastructure.