Skip to content
Today
Sections

Security Reports disagree5 publishers 2 min read Published Updated

North Macedonian police arrest a 20-year-old accused of running the OLVX stolen-data market

North Macedonia and the FBI arrested the alleged OLVX administrator, accused of selling stolen data through 1,500-plus seller accounts. The suspect, 20, also ran the ONEMILI Telegram fraud-tools group, police said.

The Watch · Security desk

Send a correction

Illustration accompanying North Macedonian police arrest a 20-year-old accused of running the OLVX stolen-data market
Generated illustration
OLVX is alleged to have sold stolen logins Figures reported on OLVX's alleged trade: the FBI's seller-account count, officials' sales total from April and the credential sets officials say were offered.

Three figures on OLVX: over 1,500 seller accounts used to sell personal data and logins, per the FBI, disputed; sales that exceeded $500,000, per officials at the April action, unconfirmed; more than 1,500 sets of stolen credentials offered for sale, per officials, disputed.

OLVX is alleged to have sold stolen logins
FigureValueNoteClaim
Seller accounts used to sell data and logins, over, per FBI1,500 accountsdisputed16
Platform sales, exceeded, per officials in April500,000 US dollarsunconfirmed19
Stolen credential sets offered, more than, per officials1,500 setsdisputed18

What happened

  • Officials identified the suspect only as E.A. and charged him with computer fraud, misuse of personal data, and production and distribution of child sexual abuse material, CyberScoop reported.
  • The raid on the man's home came after charges were filed, the FBI and North Macedonia said.
  • ZeroFox warned in a 2023 investigation that OLVX was growing popular with criminals selling phishing kits, remote desktop connections, credentials and stolen data.
  • OLVX ran without escrow: users loaded funds onto the site and paid each other from those balances in cryptocurrency.
  • The FBI provided intelligence to North Macedonian authorities and aided the joint investigation, CyberScoop reported.

Why it matters

  • Who's exposed exposure Logins sold on OLVX between 2023 and 2025 stay usable until their owners change them, and the arrest changes none of them.
  • What doesn't add up contradiction The FBI counts more than 1,500 seller accounts, while officials cited by CyberScoop count more than 1,500 sets of stolen credentials. The market's scale depends on which unit is right.
  • What it sets up precedent OLVX opened in 2023, inside the five-year span in which law enforcement has taken down dozens of marketplaces. Takedowns have not stopped new ones from forming.

The April figures are the best sizing in the record. Officials said at the time that sales exceeded $500,000 and that a seized server held a database with more than 2,600 customer accounts [19]. The FBI's claim is wider: "The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use," the agency said [9].

Timing is unsettled. The Record reported the arrest as this week's [14]. CyberScoop, citing European authorities, said this week's arrest came six months after authorities dismantled the platform, arrested the alleged administrator and searched the home in April [17]. Neither report explains how the two actions relate.

Telegram is where the other allegations sit. North Macedonian police said the suspect ran ONEMILI, a group offering tools for fraudulent refund schemes and other scams [1]. CyberScoop reported that authorities accuse the suspect of running a Telegram group selling illegal services and software earlier this year [3].

The Interior Ministry's wording on the child abuse material is narrower than the charge list CyberScoop gives. The ministry said "evidence was obtained indicating that the suspect had acquired and possessed child sexual abuse material (CSAM) for personal use through the Telegram application" [2].

OLVX is one of three actions in the same stretch. Last week the co-creator of the dark web forum Empire Market was sentenced to 40 years in federal prison [12]. On Wednesday Microsoft announced a takedown of three Chinese phishing sites that sent hundreds of millions of malicious messages impersonating more than 75,000 organizations [13].

What to watch

  • A North Macedonian or FBI filing that states whether this week's arrest follows the April arrest and which child abuse material charges apply.
  • Any US-side filing or victim notice that says how many of the listed credentials belonged to American accounts.
  • Whether the ONEMILI Telegram group and the OLVX domains stay online or go dark.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence58
Adoption
Not scored
Hype gap+10
Incentives55
Confidence66

Perspective Coverage

5 publishers
Builder
Builder 4%
Operator
Operator 86%
Investor
Investor 10%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    North Macedonian police said the suspect also ran a Telegram group called ONEMILI that offered tools for fraudulent refund schemes and other scams.

    Reported Supported Source: North Macedonian police, per The RecordView cited source
  2. [2]

    North Macedonia's Interior Ministry said: "evidence was obtained indicating that the suspect had acquired and possessed child sexual abuse material (CSAM) for personal use through the Telegram application".

    Reported Supported Source: North Macedonia's Interior Ministry, quoted by The RecordView cited source
  3. [3]

    More recently, including earlier this year, authorities accused the suspect of running an online group on Telegram where illegal services and software were sold to facilitate cybercrime, including fraudulent refund schemes.

    Reported Supported Source: CyberScoop, citing authoritiesView cited source
  4. [4]

    OLVX let criminals pay each other in cryptocurrency instead of operating an escrow service; users loaded funds onto the site and paid each other with the funds sent to the platform.

    Reported Supported Source: The RecordView cited source
  5. [5]

    Officials identified the suspect as "E.A." in a news release; he is accused of computer fraud, misuse of personal data, and production and distribution of child sexual abuse material.

    Reported Supported Source: CyberScoop, citing a North Macedonian news releaseView cited source
  6. [6]

    The FBI provided intelligence to North Macedonian authorities and aided the joint investigation into OLVX.

    Reported Supported Source: CyberScoopView cited source
  7. [7]

    The FBI Cyber Division said in a LinkedIn post that the disruption is the first-ever cyber operation coordinated between the FBI and North Macedonia.

    Reported Supported Source: FBI Cyber Division LinkedIn post, quoted by CyberScoopView cited source
  8. [8]

    The suspect is a 20-year-old citizen of North Macedonia.

    Reported Supported Source: CyberScoopView cited source
  9. [9]

    The FBI said: "The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use."

    Reported Supported Source: FBI statement, quoted by The RecordView cited source
  10. [10]

    Cybersecurity firm ZeroFox published an investigation into OLVX in 2023, warning that the site was becoming increasingly popular among cybercriminals selling phishing kits, remote desktop connections, credentials, stolen data and other tools.

    Reported Supported Source: The Record, describing ZeroFox's 2023 reportView cited source
  11. [11]

    Law enforcement agencies have taken down dozens of cybercriminal marketplaces over the last five years.

    Reported Supported Source: The RecordView cited source
  12. [12]

    Last week, the co-creator of the dark web cybercriminal forum Empire Market was sentenced to 40 years in federal prison.

    Reported Supported Source: The RecordView cited source
  13. [13]

    Microsoft announced on Wednesday a takedown of three popular Chinese phishing sites used to send hundreds of millions of malicious messages impersonating over 75,000 organizations worldwide.

    Reported Supported Source: The RecordView cited source
  14. [14]

    The administrator behind the OLVX cybercriminal marketplace was arrested this week in North Macedonia in a joint operation between the country's Ministry of Interior and the FBI.

    Reported Contested Source: The Record (Recorded Future News)View cited source
  15. [15]

    The FBI and North Macedonia said a raid on the man's home in a village was conducted after charges were filed; the suspect was not named.

    Reported Contested Source: The Record, citing the FBI and North MacedoniaView cited source
  16. [16]

    The FBI said in a statement that OLVX, active between 2023 and 2025, is alleged to have unlawfully sold victims' personally identifiable information and login credentials via over 1,500 seller accounts.

    Reported Contested Source: FBI statement, quoted by The RecordView cited source
  17. [17]

    According to European authorities, this week's arrest comes six months after authorities dismantled the platform, arrested the alleged administrator and searched their home in April.

    Reported Contested Source: CyberScoop, citing European authoritiesView cited source
  18. [18]

    Officials said evidence gathered in the investigation showed the suspect allegedly offered more than 1,500 sets of stolen credentials for sale.

    Reported Contested Source: CyberScoop, citing officialsView cited source
  19. [19]

    Officials said at the time of the April action that the platform's sales exceeded $500,000 and a seized server contained a database with more than 2,600 customer accounts.

    Reported Insufficient Source: CyberScoop, citing officialsView cited source

Sources

5 independent publishers whose own reporting we read for this story.

  1. cyberscoop.com

    1 article · October 14, 2026

    Authorities charge alleged OLVX cybercrime marketplace operator in North Macedonia

  2. mvr.gov.mk

    1 article · October 15, 2026

    North Macedonia Ministry of Interior
  3. scworld.com

    1 article · October 15, 2026

    North Macedonia charges alleged administrator of OLVX cybercrime marketplace
  4. thecyberexpress.com

    1 article · October 14, 2026

    OLVX Marketplace Dismantled After Joint FBI-North Macedonia Probe
  5. therecord.media

    1 article · October 14, 2026

    North Macedonian police arrest alleged administrator behind OLVX cybercrime market

Topics and entities

Topics

  • International law enforcement cooperation
  • Cybercrime marketplaces
  • Stolen credentials

Entities