Identities for sale: how Rydox, the illegal marketplace of two brothers from Kosovo, worked

Names, addresses, bank details, and account credentials were sold on an illegal online marketplace run by two brothers from Kosovo. Rydox operated for years, offering buyers stolen data and tools that could be used for fraud and other online crimes. US court documents obtained by Radio Free Europe show how the marketplace worked, how the FBI tracked it, and how the investigation led to Ardit and Jetmir Kutleshi. Both brothers have pleaded guilty in the US. Jetmir Kutleshi has been sentenced, while Ardit is expected to learn his punishment in February 2027.

In November 2022, a new user opened an account on the Rydox platform, depositing $300 worth of cryptocurrency.

On that illegal website, he then bought about 40 packages containing stolen personal data: names, addresses, dates of birth, social security numbers, and driver’s license numbers.

But the buyer was no ordinary user. Behind him stood a confidential source of the US Federal Bureau of Investigation (FBI). Among the data provided to him were those of a person from Pennsylvania, whose identity was sold without his knowledge and permission.

The purchase was part of the investigation that would lead US authorities to two brothers in Kosovo, Ardit and Jetmir Kutleshi, who, according to prosecutors, had created and administered the illegal marketplace.

Radio Free Europe obtained the US court documents, including the indictment and the plea agreement, describing the undercover purchases, the tracing of payments, and the communications among the illegal marketplace’s administrators. They show how Rydox worked, and how the sale of stolen data was linked to the people who ran it.

Although the FBI investigation began in 2022, Rydox had existed for years. According to the indictment, the Kutleshi brothers had administered the unlawful marketplace since at least February 2016.

With an interruption between 2019 and 2020, the platform existed until the end of 2024, when it ceased to exist after the US authorities’ operation.

In 2024, the two brothers were indicted on six criminal counts.

Jetmir Kutleshi pleaded guilty to the third count of the indictment — “Conspiracy to transfer, possess, or use an identification device.”

He was sentenced in 2025, and the sentence credited the roughly 12 months held in pre-trial detention. Upon completing the sentence, the decision foresaw his return to Kosovo and a restriction on his entry into the US.

Meanwhile, his brother Ardit pleaded guilty in September 2026 to the first and sixth counts of the indictment: “Conspiracy to launder money” and “aggravated identity theft.”

He is expected to learn his sentence at the start of 2027.

A third Kosovo citizen, Shpend Sokoli, was arrested in Albania as a collaborator of the Kutleshi brothers, and, according to Albanian media, in May 2026 was sentenced at first instance to 3 years and 8 months in prison.

Radio Free Europe tried to get a comment from the brothers’ defense lawyer, as well as from Jetmir Kutleshi himself, but received no reply by the time this article was published.

How did Rydox work?

For users, entry into Rydox began with an email address and an account.

To buy products, they first had to deposit cryptocurrency. The marketplace accepted several types of cryptocurrency, including Bitcoin.

The money went into digital wallets controlled by Rydox, while users could spend their account balance on the products offered.

The catalog included bank card data, passwords, and credentials for logging into email accounts, for online shopping, or for accounts on romantic dating websites.

Also sold were phishing pages, tools for sending spam messages, and guides for criminal activity online.

The packages bought by the FBI’s confidential source were known as “fullz.” The indictment describes them as sets of identifying data and credentials, typically used for financial fraud.

So buyers could secure in one place stolen data and tools to use in crimes. The documents do not specify the price of each of the roughly 40 packages bought by the FBI source — the $300 was a deposit into the account, not necessarily the amount spent on that purchase.

According to the indictment data, the marketplace’s reach was much larger.

To profit from Rydox, the administrators also charged a fee to those who wanted to sell stolen data.

According to the indictment, a user had to pay a one-time fee to become a seller. During Rydox’s operation, the fee ranged from $200 to $500, and was paid in cryptocurrency. The seller then set the price of the products themselves.

From each sale, 60 percent of the amount went to the seller, while 40 percent was kept by Rydox. In this way, the marketplace secured revenue both from seller fees and from their sales.

Behind the illegal platform there was also daily work: answering users, paying for servers, updates, and distributing digital materials or products.

According to the statement of FBI agent Micah Mayotte, presented in the document requesting the brothers’ extradition from Kosovo, Ardit Kutleshi answered user requests, used administrative accounts, and paid for the domain and services that kept the website running.

Jetmir Kutleshi helped with updating the website and the server, as well as with an account for storing and distributing digital materials.

The indictment also alleged that both used Rydox accounts to sell stolen data for access to accounts, phishing pages, and spam tools.

The activity was interrupted from August 2019 to September 2020.

From the communications between the administrators and a collaborator, the FBI concluded that during that period they were working on changing and updating the website.

Money tracing was another element the FBI used to link Rydox to the Kutleshi brothers.

The FBI said part of the revenue went from Rydox’s wallets to wallets controlled by the defendants.

Ardit Kutleshi, according to investigators, used the marketplace’s revenue also to pay for the server and other services. Using crime proceeds to continue the activity was one of the elements of the money-laundering conspiracy charge.

Meanwhile, the FBI’s undercover purchases on Rydox continued. On May 22, 2024, an FBI confidential source bought identifying data of a victim, and login data to a subscription account of another victim.

At least six victims mentioned in the indictment are from the Western District of Pennsylvania.

The FBI said it interviewed victims to confirm the accuracy of the information, and to verify that the data had been sold without their permission. Investigators also analyzed a forensic copy of Rydox’s server.

But to link the transactions to the administrators, investigators also examined the accounts they used outside the marketplace.

According to the FBI, the brothers had used their real names and identification documents to open cryptocurrency accounts.

Investigators compared email addresses and phone numbers. In their accounts they also found communications about administering Rydox, sharing passwords, invoices, and user requests.

On December 12, 2024, Ardit and Jetmir Kutleshi were arrested in Kosovo, at the request of the US. In Albania, Shpend Sokoli, a Kosovo citizen identified by the US Department of Justice as a third administrator of Rydox, was also arrested.

The operation also hit the marketplace’s infrastructure — US authorities seized the domain, while the FBI and Malaysian police seized Rydox’s servers.