North Macedonian police arrest a 20-year-old accused of running the OLVX stolen-data market
North Macedonia and the FBI arrested the alleged OLVX administrator, accused of selling stolen data through 1,500-plus seller accounts. The suspect, 20, also ran the ONEMILI Telegram fraud-tools group, police said.
The Watch · Security desk
Three figures on OLVX: over 1,500 seller accounts used to sell personal data and logins, per the FBI, disputed; sales that exceeded $500,000, per officials at the April action, unconfirmed; more than 1,500 sets of stolen credentials offered for sale, per officials, disputed.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Seller accounts used to sell data and logins, over, per FBI | 1,500 accounts | disputed | 15 |
| Platform sales, exceeded, per officials in April | 500,000 US dollars | unconfirmed | 19 |
| Stolen credential sets offered, more than, per officials | 1,500 sets | disputed | 17 |
What happened
- Officials identified the suspect only as E.A. and charged him with computer fraud, misuse of personal data, and production and distribution of child sexual abuse material, CyberScoop reported.
- The raid on the man's home came after charges were filed, the FBI and North Macedonia said.
- ZeroFox warned in a 2023 investigation that OLVX was growing popular with criminals selling phishing kits, remote desktop connections, credentials and stolen data.
- OLVX ran without escrow: users loaded funds onto the site and paid each other from those balances in cryptocurrency.
- The FBI provided intelligence to North Macedonian authorities and aided the joint investigation, CyberScoop reported.
Why it matters
- exposure Logins sold on OLVX between 2023 and 2025 stay usable until their owners change them, and the arrest changes none of them.
- contradiction The FBI counts more than 1,500 seller accounts, while officials cited by CyberScoop count more than 1,500 sets of stolen credentials. The market's scale depends on which unit is right.
- precedent OLVX opened in 2023, inside the five-year span in which law enforcement has taken down dozens of marketplaces. Takedowns have not stopped new ones from forming.
The April figures are the best sizing in the record. Officials said at the time that sales exceeded $500,000 and that a seized server held a database with more than 2,600 customer accounts [19]. The FBI's claim is wider: "The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use," the agency said [9].
Timing is unsettled. The Record reported the arrest as this week's [1]. CyberScoop, citing European authorities, said this week's arrest came six months after authorities dismantled the platform, arrested the alleged administrator and searched the home in April [18]. Neither report explains how the two actions relate.
Telegram is where the other allegations sit. North Macedonian police said the suspect ran ONEMILI, a group offering tools for fraudulent refund schemes and other scams [3]. CyberScoop reported that authorities accuse the suspect of running a Telegram group selling illegal services and software earlier this year [8].
The Interior Ministry's wording on the child abuse material is narrower than the charge list CyberScoop gives. The ministry said "evidence was obtained indicating that the suspect had acquired and possessed child sexual abuse material (CSAM) for personal use through the Telegram application" [16].
OLVX is one of three actions in the same stretch. Last week the co-creator of the dark web forum Empire Market was sentenced to 40 years in federal prison [13]. On Wednesday Microsoft announced a takedown of three Chinese phishing sites that sent hundreds of millions of malicious messages impersonating more than 75,000 organizations [14].
What to watch
- A North Macedonian or FBI filing that states whether this week's arrest follows the April arrest and which child abuse material charges apply.
- Any US-side filing or victim notice that says how many of the listed credentials belonged to American accounts.
- Whether the ONEMILI Telegram group and the OLVX domains stay online or go dark.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives50
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The administrator behind the OLVX cybercriminal marketplace was arrested this week in North Macedonia in a joint operation between the country's Ministry of Interior and the FBI.
- [2]
The FBI and North Macedonia said a raid on the man's home in a village was conducted after charges were filed; the suspect was not named.
- [3]
North Macedonian police said the suspect also ran a Telegram group called ONEMILI that offered tools for fraudulent refund schemes and other scams.
- [4]
Officials identified the suspect as "E.A." in a news release; he is accused of computer fraud, misuse of personal data, and production and distribution of child sexual abuse material.
- [5]
The FBI provided intelligence to North Macedonian authorities and aided the joint investigation into OLVX.
- [6]
The FBI Cyber Division said in a LinkedIn post that the disruption is the first-ever cyber operation coordinated between the FBI and North Macedonia.
- [7]
The suspect is a 20-year-old citizen of North Macedonia.
- [8]
More recently, including earlier this year, authorities accused the suspect of running an online group on Telegram where illegal services and software were sold to facilitate cybercrime, including fraudulent refund schemes.
- [9]
The FBI said: "The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use."
- [10]
Cybersecurity firm ZeroFox published an investigation into OLVX in 2023, warning that the site was becoming increasingly popular among cybercriminals selling phishing kits, remote desktop connections, credentials, stolen data and other tools.
- [11]
OLVX let criminals pay each other in cryptocurrency instead of operating an escrow service; users loaded funds onto the site and paid each other with the funds sent to the platform.
- [12]
Law enforcement agencies have taken down dozens of cybercriminal marketplaces over the last five years.
- [13]
Last week, the co-creator of the dark web cybercriminal forum Empire Market was sentenced to 40 years in federal prison.
- [14]
Microsoft announced on Wednesday a takedown of three popular Chinese phishing sites used to send hundreds of millions of malicious messages impersonating over 75,000 organizations worldwide.
- [15]
The FBI said in a statement that OLVX, active between 2023 and 2025, is alleged to have unlawfully sold victims' personally identifiable information and login credentials via over 1,500 seller accounts.
- [16]
North Macedonia's Interior Ministry said: "evidence was obtained indicating that the suspect had acquired and possessed child sexual abuse material (CSAM) for personal use through the Telegram application".
- [17]
Officials said evidence gathered in the investigation showed the suspect allegedly offered more than 1,500 sets of stolen credentials for sale.
- [18]
According to European authorities, this week's arrest comes six months after authorities dismantled the platform, arrested the alleged administrator and searched their home in April.
- [19]
Officials said at the time of the April action that the platform's sales exceeded $500,000 and a seized server contained a database with more than 2,600 customer accounts.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- cyberscoop.comAuthorities charge alleged OLVX cybercrime marketplace operator in North Macedonia
1 article · October 14, 2026
- therecord.mediaNorth Macedonian police arrest alleged administrator behind OLVX cybercrime market
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.