North Macedonia arrests alleged OLVX market admin: joint FBI operation takes down a stolen-data marketplace
A 20-year-old man in North Macedonia has been arrested on suspicion of operating OLVX, a cybercrime marketplace that sold stolen personal data and login credentials. The arrest was carried out jointly by the country's cybercrime unit and the FBI, according to reporting by The Record. The marketplace operated for roughly two years, from about 2023 to 2025, and illicit sales through the platform reportedly exceeded $500,000.
A joint raid in a village
The operation paired North Macedonia's cybercrime investigators with the FBI. According to The Record, which reported the case on October 14, officers raided the suspect's home in a village and took him into custody. Devices seized during the search were examined afterwards, and the material recovered from them now forms part of the evidence in the case. The Council of Europe's cybercrime programme, which supports the country on cybercrime matters and international cooperation, noted the disruption of the illegal marketplace in a statement on its website. Corroborating coverage followed from specialist outlets, including The Cyber Express. Raids of this kind usually come after months of cooperation between the services involved, with evidence compiled across borders before an arrest is attempted. What OLVX sold
OLVX was not a drug market or an arms bazaar. It dealt in data. Sellers on the platform offered stolen personal information and login credentials to buyers, and The Record reports that more than 1,500 seller accounts were active over the site's lifetime. CyberScoop, citing figures reported in connection with the case, writes that illicit sales through the marketplace reportedly exceeded $500,000. The market ran from roughly 2023 until 2025, after which it went offline. The public reporting does not detail the site's exact inventory, though platforms of this type typically list credential dumps, account logins and personal records harvested from infostealer infections or breached databases. - Active from approximately 2023 to 2025
- More than 1,500 seller accounts over its lifetime
- Main goods: stolen personal data and login credentials
- Illicit sales reportedly above $500,000
Markets of this kind sit at the start of a supply chain. Credentials and personal records sold there are typically harvested through infostealer malware or leaks from breached services, then resold to buyers who use them for account takeover, payment fraud, or resale to yet another buyer. We looked at one corner of this trade in our piece on dark-web access sales, which covers how access to compromised accounts and systems is packaged and priced. Removing a venue like OLVX interrupts that chain at the distribution stage, though it rarely reaches the operators upstream who produce the stock in the first place. The ONEMILI Telegram group
The suspect is additionally linked to ONEMILI, a Telegram group that he allegedly ran and that was used to coordinate refund-fraud scams. Refund fraud, in its common form, abuses merchant refund policies: purchases are made with stolen or controlled payment instruments, and the attacker then manipulates the refund process so that money flows back while the goods or the scheme's proceeds stay with the fraudster. The resulting losses are absorbed by merchants and payment providers. Telegram groups devoted to these techniques operate in relative openness and have become standard venues where methods, tools and stolen data change hands. According to The Record, the group was run by the same suspect now arrested in the case. Separate allegations in the same case
The search also surfaced a more serious thread. Reporting by The Record states that evidence of child sexual abuse material, linked to the suspect's use of Telegram, was found on the seized devices. That finding is distinct from the marketplace allegations and could lead to additional charges. Full details of the indictment have not been made public, and how the case proceeds through the North Macedonian courts remains to be seen. What the case says about takedowns
Operations against mid-sized data markets have become a routine output of cooperation between United States agencies and police forces in southeastern Europe. The pattern here will be familiar from earlier cases: local investigators execute the raid and the seizures, while US partners contribute attribution and case-building support. Public acknowledgement from Council of Europe structures reflects how much the region's enforcement depends on cross-border cybercrime frameworks for this kind of coordinated action. It is the same division of labour seen in many takedowns announced over the past few years. For the marketplace's former users, the practical effect is the usual one: a venue disappears and activity shifts elsewhere. For anyone tracking the underground data economy, the case is another reminder that running a platform for stolen credentials and personal data carries a real risk of arrest, including in jurisdictions that have sometimes been treated by operators as out of reach.
