The FBI tracked Ardi and Jetmir Kutlesh – how Rydox, the illegal market of two brothers from Kosovo, worked
tidings
Express Newspaper
29/09/2026 16:16
Names, addresses, bank details and account credentials were being sold in an illegal online marketplace run by two brothers from Kosovo. Rydox operated for years, providing buyers with stolen data and tools that could be used for fraud and other online crimes. American court documents, obtained by Radio Free Europe, show how this market worked, how the FBI tracked it and how the investigation led to Ardi and Jetmir Kutleshi. Both brothers have pleaded guilty in the US. Jetmir Kutleshi has been sentenced, while Arditi is expected to learn the punishment measure in February 2027.
In November 2022, a new user opened an account on the Rydox platform, where he deposited 300 US dollars worth of cryptocurrency.
Then, on this illegal website, he bought about 40 packages, which contained stolen personal data: names, addresses, dates of birth, social security and driver’s license numbers.
But the buyer was not an ordinary user. Behind him was a secret source of the Federal Bureau of Investigation (FBI) of the United States. Among the data he provided was that of a Pennsylvania man whose identity was sold without his knowledge and permission.
This purchase was part of the investigation that would lead the American authorities to two brothers in Kosovo, Ardit and Jetmir Kutleshi, who, according to the prosecution, had created and administered the illegal market.
Radio Free Europe has obtained US court documents, including the indictment and plea agreement, which describe the secret purchases, tracking of payments and communications between the administrators of the illegal market. They show how Rydox operated, and how the sale of stolen data was linked to the people who ran it.
Although the FBI’s investigation began in 2022, Rydox had been around for years. According to the indictment, the Kutleshi brothers managed the illegal market at least from February 2016.
With a break in the middle of 2019-2020, the platform existed until the end of 2024, when it ceased to exist after the operation of the American authorities.
In 2024, two brothers were charged with six criminal offences.
Jetmir Kutleshi pleaded guilty to the third point of the indictment – “Conspiracy for the transfer, possession or use of an identification tool”.
He was sentenced in 2025, while the time of about 12 months held in custody was counted in the announced measure. Upon completion of his sentence, according to the decision, he was expected to return to Kosovo and be restricted from entering the US.
Meanwhile, his brother, Arditi, pleaded guilty in September 2026, to the first and sixth counts of the indictment: “Conspiracy to launder money” and “aggravated identity theft”.
He is expected to learn the sentence in early 2027.
A third citizen of Kosovo, Shpend Sokoli, was arrested in Albania as an associate of the Kutleshi brothers, and, according to the Albanian media, in May 2026 he was sentenced in the first degree to 3 years and 8 months of imprisonment.
Radio Evropa e Lire tried to get a comment from the defense lawyer of the brothers, as well as from Jetmir Kutleshi himself, but until the publication of this article he did not receive a response.
How did Rydox work?
For users, logging into Rydox started with an email address and an account.
To buy the products, they first had to deposit cryptocurrency. The market accepted cryptocurrencies of several types, including Bitcoin.
Money was transferred to digital wallets, controlled by Rydox, while users could spend their account balance on the products offered.
In the catalog were bank card details, passwords, and credentials for accessing email accounts, for online shopping, or for accounts on romantic dating websites.
Scam sites, spamming tools, and guides to online criminal activity were also sold.
The packages that the undercover FBI source purchased were known as “fullz.” The indictment describes them as sets of identification data and credentials, commonly used for financial fraud.
So buyers could secure stolen data and tools to use in crimes in one place. The documents do not specify the price of each of the approximately 40 packages purchased by the FBI source — the $300 was the deposit in the account, not necessarily the amount spent on that purchase.
According to the data in the indictment, the scope of the market was much larger.
In order to profit from Rydox, administrators also demanded payment from those who wanted to sell stolen data.
According to the indictment, a user had to pay a one-time fee to become a seller. During Rydox’s operation, the fee ranged from $200 to $500, and was paid in cryptocurrency. Then, the seller set the price of the products himself.
From each sale, 60 percent of the amount went to the seller, while 40 percent was kept by Rydox. Thus, the market provided income both from the sellers’ fees and from their sales.
Behind the illegal platform there was also daily work: responding to users, paying for servers, updating and distributing digital materials or products.
According to FBI agent Micah Mayotte’s statement in the document seeking the brothers’ extradition from Kosovo, Ardit Kutleshi responded to user requests, used administrative accounts, and paid for the domain and services that kept the website up and running.
Jetmir Kutleshi helped with website and server updates, as well as an account for storage and distribution of digital materials.
The indictment also alleged that the two used Rydox accounts to sell stolen account credentials, phishing pages and spamming tools.
The event had a hiatus from August 2019 to September 2020.
From communications between the administrators and an associate, the FBI concluded that during that period they were working on changing and updating the website.
The money trail was another element the FBI used to link Rydox to the Kutleshi brothers.
The FBI said a portion of the proceeds went from Rydox wallets to wallets controlled by the defendants.
Ardit Kutleshi, according to the investigators, used the income from the market to pay for the server and other services. Using the proceeds of crime to carry on the business was one of the elements of the money laundering conspiracy charge.
Meanwhile, the FBI’s undercover purchases of Rydox continued. On May 22, 2024, an undercover FBI source purchased one victim’s identifying information, and another victim’s subscription account login information.
At least six victims named in the indictment are from the Western District of Pennsylvania.
The FBI said it interviewed the victims to confirm the accuracy of the information, and to verify that the data was sold without their permission. Investigators also analyzed a forensic copy of Rydox’s server.
But to link the transactions to the administrators, investigators also looked at the accounts they used outside the market.
According to the FBI, the brothers had used their real names and identification documents to open cryptocurrency accounts.
Investigators matched email addresses and phone numbers. In their accounts they also found communications about Rydox administration, password sharing, invoices and user requests.
On December 12, 2024, Ardit and Jetmir Kutleshi were arrested in Kosovo, at the request of the USA. Shpend Sokoli, a citizen of Kosovo, was also arrested in Albania, whom the US Department of Justice identified as Rydox’s third administrator.
The operation also hit the infrastructure of the market – the US authorities seized the domain, while the FBI and Malaysian police seized Rydox’s servers./REL/
