For roughly ten years, a marketplace called Rydox moved other people’s identities and break-in tools. On September 25, its 28-year-old operator admitted to it in a US courtroom.
Ardit Kutleshi, a Kosovo citizen, entered a guilty plea in the Western District of Pennsylvania. The charges were aggravated identity theft and money laundering conspiracy. Prosecutors put the marketplace’s lifetime takings at more than $232,000, across over 7,600 transactions involving stolen personal data, access cards, and criminal tooling.
The storefront listed more than 321,000 products to about 18,000 users, and thousands of victims in the United States were caught up in it. Court records date the operation to February 2016.
Kutleshi faces two years behind bars at minimum on the identity theft count. The money laundering charge carries up to 20 years. He returns to court for sentencing on February 9, 2027.
His brother Jetmir was part of the operation too. Jetmir pleaded guilty in a separate proceeding, drew a sentence in December 2025, and was deported back to Kosovo.
Closing the case took several countries. Kutleshi’s arrest happened in Kosovo in December 2024. The Rydox.cc domain was seized at the same time, and he was extradited to face charges in the US. Malaysian police raided servers in Kuala Lumpur, and American authorities seized $225,000 in cryptocurrency. Kosovo’s special prosecution office, an Albanian anti-corruption body, and Malaysian police and prosecutors all contributed.
Prosecutors argue the identity theft count understates the toll, since stolen records trail victims through credit checks, background checks, and account recovery long after a fraudulent charge is reversed.
