Kutleshi Pleads Guilty: Rydox Marketplace Operator Faces Up to 22 Years in Prison
Kosovo national Ardit Kutleshi pleaded guilty in federal court in Pennsylvania to operating Rydox, a marketplace for stolen data and cybercrime tools.
Kutleshi’s guilty plea moves the cybercrime marketplace case toward sentencing. Ardit Kutleshi, a 28-year-old Kosovo national, pleaded guilty on September 22, 2026, in the U.S. District Court for the Western District of Pennsylvania to aggravated identity theft and conspiracy to commit money laundering. The U.S. Department of Justice (DOJ) announced the case on September 24.
According to the DOJ, Kutleshi created and operated Rydox, an online marketplace intended for selling and exchanging stolen personal information, login credentials, access devices, and tools or services usable in cybercrime.
What Kutleshi’s Guilty Plea Means
Kutleshi pleaded guilty to two counts: aggravated identity theft and conspiracy to commit money laundering. This is a guilty plea, not an already imposed sentence. Sentencing is scheduled for February 9, 2027, and the final decision will be up to the federal judge.
The combination of these offenses carries a mandatory minimum of two years in prison and a statutory maximum of 22 years. The stated 22 years therefore represents the maximum statutory sentencing exposure, not a confirmed sentence length.
Rydox Operated From 2016
The Department of Justice states that Rydox processed more than 7,600 transactions and generated at least $232,000 from 2016 onward. The material traded included data stolen from victims in the United States.
These marketplaces connect sellers of stolen data with people seeking access, tools, or services for further criminal activity. The sale of login credentials and identifying data can serve as an entry point for fraud and subsequent cyberattacks.
However, the publicly available announcement does not state the full extent of the damage caused or the number of individual victims. It also does not identify all people who may have used the platform or participated in its operation.
Authorities Seized the Domain in December 2024
The Rydox.cc domain was seized by court order in December 2024. Kutleshi was arrested in Kosovo in December 2024 and extradited to the United States in 2025. Rydox has been offline since the domain was seized.
The case is now heading toward the February sentencing decision. Further court documents may provide more detailed information about victims, associates, or additional proceedings involving people connected to the use or operation of Rydox.
Sources
- U.S. Department of Justice, U.S. Attorney’s Office for the Western District of Pennsylvania – Primarily confirms the guilty plea, offenses, information about Rydox, the domain seizure, extradition to the United States, the sentencing date, and statutory penalties.
- BleepingComputer – Independently describes the case as the guilty plea of an administrator of a marketplace selling stolen data and cybercrime tools.
- SecurityWeek – Corroborates that Kutleshi operated Rydox for trading personal data and cybercrime services.
Verified and updated: 09/25/2026 15:25
