Threat Intelligence
Alleged Operator of OLVX Cybercrime Marketplace Arrested in North Macedonia
Authorities in North Macedonia have arrested a 20-year-old accused of running OLVX, a cybercrime marketplace that sold stolen data and malicious tools. The platform reportedly endangered thousands of people and made over $500,000 in illicit sales.
Ross GrantUpdated 3 min read
The short version
A 20-year-old in North Macedonia has been arrested for allegedly running OLVX, a website where criminals bought and sold stolen personal data and hacking tools. The site reportedly made over $500,000 and put thousands of people at risk. Authorities from North Macedonia and the FBI worked together to shut it down. This case highlights the ongoing fight against online marketplaces that trade in stolen information.
By the numbers
- $500,000+illicit sales through OLVX since 2023CyberScoop
- 2,600+customer accounts in OLVX databaseCyberScoop
- 1,500+seller accounts on OLVXRecorded Future News
What happened?
Authorities in North Macedonia, with support from the FBI, arrested a 20-year-old man accused of running the OLVX cybercrime marketplace. The platform allegedly sold stolen personal data, credentials, and malicious tools from 2023 to 2025, with illicit sales exceeding $500,000. The suspect was charged in April 2026 after a raid on his home.
The Arrest and Charges
Authorities in North Macedonia, working with the FBI, arrested a 20-year-old man in the village of Golema Rečica, near Tetovo, on charges of running the OLVX cybercrime marketplace. The arrest took place in April 2026, following a raid on the suspect’s home. Officials identified the suspect only as “E.A.” and charged him with computer fraud, misuse of personal data, and production and distribution of child sexual abuse material (CSAM) [Recorded Future News (opens in a new tab)][CyberScoop (opens in a new tab)].
What Was OLVX?
OLVX was an online marketplace active between 2023 and 2025. It allowed cybercriminals to buy and sell stolen personal data, login credentials, phishing kits, remote desktop access, and other tools used for cybercrime. According to the FBI, the platform operated with over 1,500 seller accounts and directly endangered the digital security of thousands of people, including many Americans. The site reportedly handled more than $500,000 in illicit sales and had a database of over 2,600 customer accounts [CyberScoop (opens in a new tab)].
How the Marketplace Worked
Unlike some other underground markets that use an escrow service to hold payments, OLVX allowed users to load funds onto the site and pay each other directly through the platform, using cryptocurrency. This made transactions fast and harder to trace. The marketplace also did not limit itself to stolen data; it sold malicious software and offered services for fraudulent refund schemes. The suspect is also accused of running a Telegram group called ONEMILI, which sold illegal tools and services to help with scams [Recorded Future News (opens in a new tab)].
The Investigation and International Cooperation
The FBI provided intelligence and support to North Macedonian authorities throughout the investigation. This was the first joint cyber operation between the two countries. The FBI stated that shutting down OLVX was important for protecting people’s online accounts and digital safety. European authorities said the platform was dismantled in April 2026, at the time of the arrest.
The Bigger Picture: Law Enforcement vs Cybercrime Markets
OLVX is just one of many cybercrime marketplaces targeted by law enforcement in recent years. These sites have become central to the underground economy, making it easier for criminals to buy and sell stolen information and hacking tools. The takedown of OLVX follows other high-profile actions, such as the sentencing of the co-creator of Empire Market and Microsoft’s recent takedown of phishing sites used by Chinese cybercriminals. Each operation disrupts the flow of illegal goods and services, but new markets often appear to take their place.
What Should You Do?
While there is no evidence that specific individuals are at risk from this case alone, the sale of stolen credentials and personal data is a reminder to use strong, unique passwords and enable multi-factor authentication (MFA) wherever possible. If you receive a notification that your data may have been compromised, change your passwords immediately and monitor your accounts for suspicious activity.
Claimed vs confirmed
- Confirmed
The suspect ran OLVX and sold stolen data and hacking tools.
Authorities in North Macedonia and the FBI have both stated the suspect was the alleged administrator of OLVX.
- Confirmed
The suspect possessed and distributed child sexual abuse material.
North Macedonian Interior Ministry said evidence was found during the investigation.
The impact
- Money
- OLVX reportedly made over $500,000 in illicit sales. If prosecuted under GDPR-like laws, fines could reach up to €20 million or 4% of annual turnover, but no fine has been announced.
- Reputation
- The arrest and takedown of OLVX sends a message that law enforcement is targeting cybercrime markets. However, these sites remain a persistent problem, and trust in online security is affected whenever such markets are active.
- Customers
- People whose data was sold on OLVX may be at risk of identity theft or fraud. They should change passwords, enable multi-factor authentication, and monitor accounts for suspicious activity.
Why it matters
OLVX made it easier for criminals to buy and sell stolen data, putting thousands of people at risk of identity theft and fraud. The arrest shows law enforcement is actively targeting these marketplaces, but new ones often appear. Everyone should use strong passwords and enable extra security features to protect their accounts.
How does it work?
OLVX was an online marketplace where criminals could buy and sell stolen personal data, login credentials, and hacking tools. Payments were made using cryptocurrency loaded onto the site, which allowed for direct transactions between users and made tracing funds more difficult. The platform also offered services for scams and fraudulent refund schemes.
Key points
- A 20-year-old was arrested in North Macedonia for allegedly running OLVX, a cybercrime marketplace.
- OLVX sold stolen data, credentials, and hacking tools, with over $500,000 in illicit sales.
- The platform endangered thousands of people, including many Americans.
- The FBI and North Macedonian police worked together to dismantle the site.
- Law enforcement continues to target cybercrime markets, but new ones often emerge.
Sources
Recorded Future News
Reference
CyberScoop
Reference
