Ardit Kutleshi pleads guilty in the U.S. to cybercrime charges; ran the Rydox platform used for buying and selling personal data

Ardit Kutleshi, 28, from Kosovo, has pleaded guilty in the United States to charges related to creating and operating the Rydox platform, an illegal online marketplace used by cybercriminals to buy and sell stolen personal data and tools for committing fraud.

According to the U.S. Department of Justice, Kutleshi pleaded guilty in the U.S. District Court for the Western District of Pennsylvania to aggravated identity theft and conspiracy to commit money laundering.

U.S. authorities say Rydox had been operating at least since 2016 and had carried out over 7,600 transactions involving stolen personal information, access devices, identification documents, and tools and services for cybercrime.

The platform’s activity generated at least $232,000 in revenue, according to court documents.

“Ardit Kutleshi’s guilty plea for operating the Rydox marketplace exposes a sophisticated scheme to profit from stolen identities and cybercrime tools,” said Principal Deputy Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.

He stressed that the case shows U.S. authorities will continue to identify and prosecute cybercriminals, wherever they are, through international cooperation and the use of advanced technology.

U.S. Attorney Troy Rivetti said Kutleshi and his brother, Jetmir Kutleshi, had run Rydox for personal gain, earning hundreds of thousands of dollars from a platform where information and tools for committing online crimes were sold.

Jetmir Kutleshi had pleaded guilty and was sentenced in December 2025, before being deported to Kosovo.

FBI Cyber Division Assistant Director Brett Leatherman said sensitive data had been put up for sale through Rydox, including identities and account login data of thousands of people.

“The FBI and its foreign partners shut down the marketplace, and now the man who created and ran it has admitted guilt,” he stated.

Kutleshi was arrested by Kosovo authorities in December 2024, and in 2025 was extradited to the United States.

In December 2024, U.S. authorities had also seized the Rydox.cc domain, making it impossible to continue using the platform for the sale and purchase of personal data and cybercrime tools.

Kutleshi is expected to be sentenced on February 9, 2027.

On the aggravated identity theft charge he faces a mandatory minimum sentence of two years in prison, while for conspiracy to commit money laundering the maximum sentence can reach up to 20 years in prison.

The final sentence will be determined by a federal judge, taking into account U.S. sentencing guidelines and other legal factors.

The investigation was conducted by the FBI in Pittsburgh, in cooperation with the Kosovo Special Prosecution Office, the Kosovo Police Directorate for the Investigation of Cybercrime, SPAK in Albania, the Royal Malaysia Police and justice authorities in Malaysia.

The U.S. Department of Justice announced that since 2020 its Computer Crime and Intellectual Property Section has secured the conviction of over 180 people for cybercrime and intellectual property violations, as well as court orders for the return of over $350 million to victims’ funds. /Telegrafi/