Security5 publishers2 min readPublished
Rydox founder Ardit Kutleshi pleads guilty over a stolen-data market that took in $232,000
Ardit Kutleshi, 28, pleaded guilty to running Rydox, which sold U.S. victims' data and fraud tools from 2016 to 2024 for at least $232,000 in revenue. Spread across 7,600-plus sales, the operators averaged about $30 each for data that buyers keep after the site is seized.
The Watch · Security desk
What happened
- Kosovo police and Albania's anti-corruption body SPAK arrested Kutleshi, his brother Jetmir and a third administrator, Shpend Sokoli, in December 2024.
- The FBI and the Royal Malaysian Police seized the servers in Kuala Lumpur that hosted the marketplace.
- Kutleshi entered his plea in federal court in the Western District of Pennsylvania, to aggravated identity theft and money laundering conspiracy.
- Jetmir Kutleshi pleaded guilty separately and was sentenced in December 2025, then deported to Kosovo.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- cost Victims keep paying after the takedown. Security Affairs notes that identity theft follows people through credit checks, background checks and account recovery for years.
- exposure Buyers of phishing kits and stealer logs took away tools for reaching victims beyond the ones Rydox listed, and seizing a server does not recall tools already delivered.
- precedent Kutleshi's 2025 extradition from Kosovo puts foreign operators of even small markets within reach of a U.S. district court, a point Security Affairs draws from the case.
Both inputs to the $30 figure are floors. Prosecutors cite "over 7,600" transactions and "at least $232,000" in revenue [3], and dividing one by the other gives about $30.50 [1]. Rydox ran for nearly nine years, from February 2016 [4] to the December 2024 seizure of the Rydox.cc domain [6]. Over that span the operators took in about $26,000 a year [2].
Rydox charged sellers a one-time fee of $200 to $500 to list. Sellers kept 60% of each sale and the market kept 40% [12]. If the $232,000 is only that 40% cut, buyers spent about $580,000 over the life of the site, or roughly $76 a purchase [3]. That average covers everything on offer: names, addresses, Social Security numbers, credentials and card data, plus phishing kits, stealer logs and spamming tools [9].
Most listed products never sold. SecurityWeek counts at least 321,372 products offered [9], and 7,600 sales is about 2.4% of that [4]. Rydox had roughly 18,000 users when it was taken down [10]. That works out to fewer than one purchase for every two accounts [5].
Buyers had to deposit Bitcoin, Monero, Ethereum, Litecoin, Tron or other coins into a Rydox-controlled wallet before they could buy [11]. U.S. authorities seized about $225,000 in cryptocurrency [8]. That is roughly 97% of the revenue prosecutors attribute to the site over its whole life [6]. Buyers loaded the wallet in advance, so part of the seized balance may be customer money that was never spent [11].
The reported case covers the administrators; none of the four published accounts describes charges against a Rydox seller or buyer [5]. U.S. Attorney Troy Rivetti of the Western District of Pennsylvania said: "These types of cybercrimes cause not only financial loss, but also ongoing psychological harm to the victims who lose both money as well as trust in institutions and the online market infrastructure." [18]
Brett Leatherman, assistant director of the FBI's Cyber Division, said: "Rydox put cybercriminal tools and sensitive data up for sale, including the stolen identities and logins of thousands of people." [17] The Justice Department's Criminal Division says its Computer Crime and Intellectual Property Section has secured convictions against more than 180 cyber and intellectual property criminals since 2020. Courts have ordered more than $350 million returned to victims [21].
Kutleshi faces a mandatory minimum of two years on the identity theft count and up to 20 years on money laundering [15]. Two dark web market cases this year drew longer terms. The owner of the Incognito drugs market got 30 years in February, and a Nemesis vendor who sold fentanyl and methamphetamine got more than 26 years [22].
What to watch
- The sentence Kutleshi receives on February 9, 2027.
- Court action against Shpend Sokoli, the third administrator.
- Any prosecution of Rydox sellers or buyers built from records on the seized Kuala Lumpur servers.