Rydox Administrator Pleads Guilty in Pittsburgh; Its Other Two Administrators Were Already Sentenced

Photo: Pelajanela, CC BY-SA 4.0, via Wikimedia Commons — The Robert F. Kennedy Department of Justice Building in Washington, D.C. The Justice Department announced Kutleshi's guilty plea on Sept. 24, 2026. Photographed in July 2023.

Ardit Kutleshi, 28, a Kosovar national, pleaded guilty in federal court in Pittsburgh to aggravated identity theft and money laundering conspiracy over his role running the Rydox cybercrime marketplace. With his plea, all three men arrested in December 2024 in the Rydox case have now either pleaded guilty or been sentenced. The Justice Department announced the plea Thursday, Sept. 24, 2026; sentencing is set for Feb. 9, 2027.

The plea

Kutleshi pleaded guilty Tuesday, Sept. 22, before U.S. District Judge Mark R. Hornak in the U.S. District Court for the Western District of Pennsylvania, according to the U.S. Attorney’s Office in Pittsburgh. He faces a mandatory minimum penalty of two years in prison for the aggravated identity theft count and a maximum penalty of 20 years in prison for the money laundering conspiracy count. Judge Hornak will determine the sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

What Rydox was

According to the U.S. Attorney’s Office in Pittsburgh, Rydox was “an illicit website and marketplace for cybercriminals to buy, sell, and trade stolen personal information, and to access devices and other tools for carrying out cybercrime and fraud.”

From the arrests to the plea

The case became public in December 2024, when the Justice Department announced the seizure of Rydox and the arrest of Ardit Kutleshi and his brother, Jetmir Kutleshi, both taken into custody in Kosovo by Kosovo law enforcement pursuant to a U.S. extradition request, to face an indictment unsealed that day in the Western District of Pennsylvania. A third administrator, Kosovo national Shpend Sokoli, was arrested the same day in Albania by that country’s Special Anti-Corruption Body. The FBI and the Royal Malaysia Police seized servers in Kuala Lumpur that had hosted the site and took it offline, and the United States judicially seized the domain www.Rydox.cc. The United States also obtained judicial authorization to seize approximately $225,000 worth of cryptocurrency from accounts controlled by the defendants — a figure distinct from the $232,000 in revenue the 2026 plea documents describe. Ardit Kutleshi was extradited from Kosovo to the United States in 2025. The case is docketed as 2:24-cr-00248 in the Western District of Pennsylvania.

The three administrators today

Jetmir Kutleshi, Ardit’s brother, pleaded guilty and was sentenced in December 2025 before being deported back to Kosovo, U.S. Attorney Troy Rivetti said; the Sept. 24 releases give no further detail on his sentence or on the charges to which he pleaded guilty. Ardit Kutleshi pleaded guilty Tuesday. Shpend Sokoli was arrested in Albania in December 2024 and, the 2024 release said, was expected to be charged and prosecuted there. Albania’s Special Court of First Instance for Corruption and Organized Crime, in decision No. 37 of May 4, 2026, found Sokoli guilty of misuse of devices, committed in collaboration within a structured criminal group, and of participating in a structured criminal group, according to a report by Albania’s public broadcaster, RTSH. The court combined those convictions into a single 5-year, 6-month sentence, then reduced it by one third under Albania’s abbreviated-trial procedure to a final term of 3 years, 8 months in prison, RTSH reported. The decision could be appealed within 15 days, according to RTSH.

The government’s numbers, 2024 and 2026

The two releases describe Rydox’s scale differently. In December 2024, prosecutors said the site “has offered for sale at least 321,372 cybercrime products to over 18,000 users,” and that the indictment alleged “over 7,600 sales … which generated at least $230,000 in revenue since its inception in or around February 2016.” In this week’s plea announcement, prosecutors said that “since at least 2016, Rydox conducted over 7,600 transactions involving stolen personally identifiable information (PII), stolen access devices, means of identification, and cybercrime tools and services, receiving at least $232,000 in revenue.” These transactions involved the sale of PII stolen from victims located in the United States. The 321,372-product figure describes what was offered for sale; the 7,600 figure describes completed transactions — two different measures of the same marketplace.

Six counts in 2024, two charges in the plea

The 2024 indictment charged each brother with six counts: two counts of identity theft, one count of conspiracy to commit identity theft, one count of aggravated identity theft, one count of access device fraud, and one count of money laundering. Ardit Kutleshi pleaded guilty to two charges: aggravated identity theft and money laundering conspiracy — a differently named charge from the indictment’s money laundering count. Neither release explains how the plea charges relate to the original indictment or what became of the other charges.

What people worried about stolen information can do

Neither the Justice Department’s Thursday release nor its Pittsburgh counterpart says anything about notifying individual Rydox victims or compensating them; the releases simply do not address it. For anyone concerned their personal information may have been exposed, the Federal Trade Commission’s consumer guidance directs people to IdentityTheft.gov, which produces a personal FTC Identity Theft Report and recovery plan, and recommends placing a fraud alert, reviewing credit reports for accounts or transactions that do not belong to them, and considering an extended fraud alert or a credit freeze. The FBI’s Internet Crime Complaint Center, at ic3.gov, is where to report the underlying crime; the center’s own data show $16.6 billion in reported losses for 2024. FBI Pittsburgh Assistant Special Agent in Charge Amie Loos said of the case, “Dismantling this platform was about more than taking a website offline—it was about disrupting the criminal infrastructure that fueled fraud and identity theft against thousands of victims.”