Kutleshi was arrested in December 2024 during a joint international operation that also shut down the Rydox marketplace, seized the Rydox[.]cc domain, and confiscated servers in Kuala Lumpur with assistance from the Royal Malaysian Police. He was extradited from Kosovo to the United States in 2025 and charged with conspiracy to commit identity theft, aggravated identity theft, two counts of identity theft, access device fraud, and money laundering.
According to court documents, between February 2016 and the marketplace's shutdown in 2024, sellers on Rydox were involved in over 7,600 sales of login credentials, credit card information, and stolen personal data — including Social Security numbers, names, and addresses — of thousands of U.S. citizens. The platform also offered more than 321,000 other "cybercrime products" for sale to over 18,000 users, including devices, software tools, and materials for committing cybercrimes.
Users had to deposit cryptocurrency — Bitcoin, Monero, Ripple, Ethereum, Litecoin, Perfect Money, Tron, or Verge — into a Rydox-controlled wallet before making purchases. The marketplace charged registered sellers a one-time fee (fluctuating between $200 and $500) to become authorized sellers, who received 60% of sale proceeds; Rydox retained the remaining 40%.
"Rydox put cybercriminal tools and sensitive data up for sale, including the stolen identities and logins of thousands of people," said Brett Leatherman, assistant director of the FBI's Cyber Division. "The FBI and its foreign partners shut the marketplace down, and now the man who created it and ran it pleaded guilty."
Kutleshi's guilty plea follows a recent crackdown on dark web marketplace operators, including a Taiwanese man sentenced to 30 years in February for running the Incognito dark web drug market.