What OLVX marketplace sold and who ran it
North Macedonian authorities charge a 20-year-old with operating the OLVX cybercrime site, which sold stolen data and tools.
Key points
- Officials charged a 20-year-old North Macedonian citizen with running the OLVX cybercrime marketplace.
- The platform allegedly sold stolen credentials, personal data, and malicious attack tools since 2023.
- Authorities say illicit sales exceeded $500,000 and involved more than 1,500 credential sets.
The OLVX cybercrime marketplace facilitated the sale of stolen personal data, account credentials, and malicious tools designed for cyberattacks. According to CyberScoop, North Macedonian authorities filed charges against the alleged operator, a 20-year-old citizen identified as E.A., for running this illicit platform. The site operated between 2023 and 2025, offering digital goods that directly compromised the security of users whose data was stolen.
What did the OLVX platform sell?
The marketplace offered a variety of illicit digital goods to buyers seeking to conduct cybercrime. Evidence gathered during the investigation revealed that the suspect allegedly listed more than 1,500 sets of stolen credentials for sale. In addition to login details, the platform sold stolen personal data and malicious tools specifically designed to launch attacks. CyberScoop reports that these items were marketed to individuals looking to compromise accounts and systems.
Who was behind the operation?
Authorities identified the alleged administrator as a 20-year-old citizen of North Macedonia, referred to as E.A. in official releases. This individual was charged in the village of Golema Rečica near Tetovo. Officials accuse E.A. of administering the domains and websites associated with the OLVX platform. The suspect is alleged to have managed the infrastructure that enabled the sale of stolen data and services between 2023 and 2025.
How large was the illicit business?
Officials stated that the cybercrime platform’s sales exceeded $500,000 since it began operations in 2023. When authorities dismantled the platform in April, they seized a server containing a database with more than 2,600 customer accounts. This data indicates a significant volume of transactions and a broad customer base for the illicit services. The FBI noted that the marketplace endangered the digital security of thousands of American citizens.
What else did the suspect do?
Beyond the OLVX marketplace, authorities accused the suspect of running an online group on Telegram earlier this year. This group was used to sell illegal services and software to facilitate various forms of cybercrime. CyberScoop reports that these activities included supporting fraudulent refund schemes. The suspect allegedly used these additional channels to expand their criminal operations beyond the primary marketplace website.
What analysts watch for
Teams usually monitor for new domain registrations linked to known cybercrime infrastructure or suspicious Telegram groups offering illicit services. Analysts examine traffic patterns for connections to seized servers or IP ranges associated with previous operations. They also look for sudden spikes in credential stuffing attempts, which often follow the leak of large databases. Checking for reused passwords across unrelated services helps identify compromised accounts before further damage occurs.
What to do and how to stay safe: OLVX
- Check if your email or phone number appears in recent data breach compilations using reputable breach notification services.
- Enable multi-factor authentication on all accounts, especially those containing sensitive personal or financial information.
- Use unique, strong passwords for every service to prevent credential stuffing attacks from compromising multiple accounts.
- Monitor bank and credit card statements regularly for unauthorized transactions that could indicate identity theft.
Step-by-step guide: Build an Incident Response Plan That Actually Works
General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who was charged with running the OLVX marketplace?
North Macedonian authorities charged a 20-year-old citizen identified as E.A. with operating the OLVX cybercrime platform.
What items were sold on the OLVX site?
The platform sold stolen personal data, more than 1,500 sets of credentials, and malicious tools for cyberattacks.
Did the FBI help with this investigation?
Yes, the FBI provided intelligence and aided in the joint investigation, calling it the first coordinated cyber operation with North Macedonia.
