Albert Gonzalez of Miami became the third suspect to admit stealing 40 million credit card records from retailers.
Gonzalez was among 11 suspects charged with breaking into the wireless networks of several US retailers in 2003 to steal credit card details.
Retailers targeted include TJX, owner of TJ Maxx in the UK, which was ordered to pay nearly $10m to 41 US states for failing to prevent the data breach engineered by Gonzalez.
His team of hackers broke into the retailers' wireless computer networks and planted software to capture credit card details from financial systems.
Some of the stolen details were sold to other criminals, and others were used by Gonzalez and his team to clone cards used to steal cash from bank cash machines.
Gonzalez could face 45 years in prison when sentenced in December.