ARDIT Kutleshi, a 28-year-old Kosovar national, has pleaded guilty in the United States to charges arising from his creation and operation of Rydox, an illicit online marketplace for stolen personal information, access devices and cybercrime tools. According to US Department of Justice (DOJ) court documents, the marketplace carried out more than 7,600 transactions since at least 2016 and generated at least $232,000.
The transactions included personally identifiable information stolen from people in the United States, including identities and login details belonging to thousands of victims.
Kutleshi pleaded guilty in the Western District of Pennsylvania to aggravated identity theft and conspiracy to commit money laundering. He was arrested by Kosovo law enforcement in December 2024, extradited to the US in 2025, and is due to be sentenced on 9 February 2027. He faces a mandatory minimum sentence of two years for aggravated identity theft and a maximum of 20 years for the money-laundering conspiracy; the final sentence will be decided by a federal judge.
US and international authorities seized the Rydox.cc domain in December 2024, preventing the site from being used to continue selling stolen information and cybercrime products. The FBI investigated with agencies in Kosovo, Albania and Malaysia. Kutleshi’s brother, Jetmir, previously pleaded guilty and was sentenced in December 2025 before being deported to Kosovo.