In November 2022, a new user signed up on an online marketplace called Rydox, deposited $300 in cryptocurrency, and bought around 40 packages of stolen personal data: names, addresses, dates of birth, Social Security numbers and driver’s license numbers.

The buyer was a confidential source working for the FBI. Among the data was the identity of a Pennsylvania resident, sold without his knowledge.

That purchase became part of an investigation that led US authorities to two brothers in Kosova, Ardit and Jetmir Kutleshi, who prosecutors say created and ran the illegal marketplace. Both have now pleaded guilty in the United States, according to court documents obtained by Radio Free Europe/Radio Liberty.

Rydox operated from at least February 2016 until the end of 2024, with a pause between August 2019 and September 2020, when investigators say the administrators were rebuilding the site.

According to the US indictment, the marketplace had around 18,000 users and offered more than 321,000 products. Since 2016, it recorded some 7,600 transactions and generated $232,284 in profit.

Its catalog offered stolen credit card data, passwords and login credentials for email, shopping and dating accounts. It also sold scam pages, spam tools and guides to online crime. The identity bundles the FBI source bought are known as “fullz”, complete sets of personal data typically used for financial fraud.

The business model extended to sellers. Anyone wanting to sell stolen data on Rydox paid a one-time fee of $200 to $500 in crypto, then set their own prices. The seller kept 60 percent of each sale, while Rydox kept 40 percent.

According to the FBI, Ardit Kutleshi handled user requests, ran administrative accounts and paid for the domain and hosting that kept the site online. Jetmir helped update the website and server and managed an account used to store and distribute digital products. The indictment also alleged that both sold stolen data and fraud tools through their own Rydox accounts.

What ultimately tied the brothers to the platform was the money. The FBI said part of Rydox’s revenue moved from the marketplace’s wallets into wallets the brothers controlled, and that they had opened cryptocurrency accounts using their real names and identity documents.