North Macedonia has filed charges against the alleged administrator of OLVX, a marketplace that sold stolen credentials and personal data, in what the FBI describes as the first cyber operation it has coordinated with the country.
Raid and Charges Against a 20-Year-Old Suspect Near Tetovo
North Macedonia’s Ministry of Interior, with FBI support, charged and raided the home of the alleged OLVX administrator, identified only as “E.A.” and aged 20, in Golema Recica near Tetovo. The charges are computer fraud, misuse of personal data, and production and distribution of child sexual abuse material. Authorities say the suspect also possessed such material obtained through Telegram.
The suspect allegedly also ran an ONEMILI Telegram group that offered tools for fraudulent refund schemes.
OLVX Seller Accounts, Crypto Payments and the 2,600 Customer Accounts on a Seized Server
OLVX was active from 2023 to 2025. Through more than 1,500 seller accounts it sold stolen personal data, login credentials, phishing kits and remote desktop access. Authorities say sales exceeded $500,000, and a seized server held more than 2,600 customer accounts. The marketplace used internal balances instead of an escrow service, and payments were made in cryptocurrency.
ZeroFox published an investigation into OLVX when the marketplace emerged in 2023.
A Disputed Timeline Over When the Suspect Was Arrested
Reports differ on timing. CyberScoop reports that the platform was dismantled and the administrator first arrested in April, about six months before the announcement. The Record reports the arrest as having happened “this week.” The charges and the operation were announced on October 14, and the April date, if accurate, means the case stayed out of public view for roughly half a year.
The sources do not explain the gap, and neither the FBI nor the Ministry of Interior has reconciled the two accounts in the material available.
First FBI Cyber Operation Coordinated With North Macedonia
The FBI’s Cyber Division called the case the first cyber operation coordinated between the bureau and North Macedonia. The prosecution proceeds in North Macedonia, with the FBI providing intelligence support rather than bringing a US case. The FBI says the marketplace endangered thousands of US account holders.
What the OLVX Case Shows About FBI Cooperation With North Macedonia
OLVX was not among the largest criminal forums, with sales that authorities put above $500,000 over its lifetime. The case shows that investigators are pursuing mid-sized credential markets and pursuing them through foreign partners where the suspects live. Cooperation with a country that has no earlier joint cyber case with the FBI also widens the number of jurisdictions in which an administrator can be reached.
The charge list mixes a fraud-marketplace case with child exploitation material allegedly found on the suspect’s devices. That combination is the reason this prosecution carries a heavier set of charges than a stolen-data case alone would. Authorities have not said whether the suspect is in custody or awaiting trial, and the sources do not specify penalties. The Ministry of Interior has not said whether other administrators or sellers face charges, and the sources identify none. Of the 1,500 seller accounts, none is attributed to a named individual in the reporting, so the number of people behind the marketplace remains unclear. The 2,600 customer accounts on the seized server are a measure of how many buyers were registered, but the sources do not say how many completed purchases or which stolen data they bought.
The ONEMILI Telegram group, which allegedly offered tools for fraudulent refund schemes, points to the overlap between marketplaces and refund-fraud communities: tools sold in one place feed the fraud schemes run in the other. The sources do not say whether the group remains active or whether any of its members have been identified.
