-
North Macedonia has filed a criminal complaint against a 20-year-old suspected of running the OLVX cybercrime marketplace.
-
Police say the site listed more than 1,500 stolen logins and other tools for online crime.
-
Investigators also tied the suspect to a Telegram group. It allegedly sold cybercrime services and fake refund schemes.
North Macedonia’s Ministry of Interior has filed a criminal complaint against a 20-year-old man. Police suspect he ran OLVX, an online marketplace that allegedly sold stolen personal data. The site also offered account logins and tools used for cybercrime, according to the ministry. Cybercrime means crimes carried out with computers or the internet.
The FBI worked with North Macedonian authorities on the case. According to the authorities, the investigation began with information from the FBI. A criminal complaint is a formal step that starts legal action against a suspect. Nobody has convicted the suspect of any crime so far. The word allegedly means police claim something that a court has not proven.
Police File Complaint Against Suspected OLVX Administrator
The ministry named the suspect only by his initials, E.A. He comes from Golema Rečica, a place near Tetovo. Investigators allege he managed domains and websites linked to OLVX between 2023 and 2025. A domain is simply the web address that people type to reach a site. A marketplace is a place where people buy and sell things. In this case, the ministry says the goods were stolen data and tools for crime.
OLVX worked through several domains. Police describe it as a marketplace where cybercriminals could get stolen personal data and account logins. Buyers could also find services built to attack accounts and computer networks.
Stolen personal data can also appear in claims involving large online platforms. A hacker recently claimed to have obtained 11 million records from Indian travel platform ixigo, although the reported samples appeared to contain SMS logs.
The FBI said OLVX threatened the digital safety of thousands of American citizens. Reports say the marketplace could put their accounts at risk of being hacked. The Council of Europe’s cybercrime program added that the platform had been running since July 2023. It also confirmed that OLVX used multiple domains.
OLVX Sales Numbers and Seized Devices Show Size of Operation
North Macedonian authorities said OLVX offered more than 1,500 stolen access credentials. They made this claim about the whole period the site operated. Stolen means taken without the owner’s permission. Credentials are the details people use to log in to their accounts. Buyers could use them to enter victims’ online accounts and computer networks. This could expose private information and open the door to more crimes, the authorities said.
The ministry announced an earlier operation on April 28, 2026. Officers acted in Golema Rečica and detained, or held, two people suspected of being marketplace administrators. They also seized desktop computers, laptops, and mobile phones. Seized means officers took the items to use as possible evidence. Experts will search these devices for digital evidence, which is called forensic examination. They can check the files, messages, and records stored on each device.
According to the ministry, the marketplace database held more than 2,600 customer accounts. It also held over 1,500 seller accounts. The ministry estimated the total value of sales at more than $500,000. Customer accounts belong to people who bought from the site. Seller accounts belong to people who listed items on it. The ministry says the database held both kinds in large numbers.
Telegram Group and Added Allegations Widen the Case
Investigators also linked the suspect to ONEMILI, a Telegram group. Telegram is a popular messaging app where many people can join one chat group. The group allegedly operated between 2025 and 2026. According to the ministry, it offered software tools and services that help carry out cybercrime. These included fraudulent refund schemes, which are tricks to get money back unfairly.
The ministry further alleges that the suspect acquired and possessed child sexual abuse material through Telegram. These claims are part of the criminal complaint. The complaint also lists suspected computer fraud, which means using computers to cheat people. It further lists misuse of personal data, which means using private details in ways the law does not allow.
The case shows North Macedonian cybercrime investigators working with the FBI. Together, they aim to find and shut down the online systems that criminals rely on. It also shows how one marketplace can hold stolen logins, personal data, and cybercrime services together.
The timeline shows how long officials say this activity lasted. The Council of Europe says OLVX ran from July 2023. The ministry says the suspect managed it between 2023 and 2025. ONEMILI allegedly ran from 2025 to 2026, and the earlier raid came in April 2026.
Such platforms can expose victims to several harms. An account takeover happens when a criminal gets into someone else’s account. Identity theft happens when a criminal uses another person’s details to pretend to be them. Financial fraud happens when criminals use these details to take money.
The investigation is still moving forward. Forensic checks on the seized devices may help authorities learn the full extent of the alleged activities. They may also help identify other people involved. Public statements do not yet show how the criminal case will end.
