Deniss Calovskis admitted in a New York court hearing that he had been hired to write part of the Gozi computer virus.
The code Calovskis wrote changed banking websites and helped make the virus more effective.
Gozi was first found in 2007 but remained active for years and is thought to have infected more than one million computers worldwide.
"I knew what I was doing was against the law," Calovskis said in court, answering charges of conspiring to commit computer intrusion.
Calovskis was extradited to the US from Latvia in February after lengthy negotiations between the two nations over the potential sentence he would serve.
Latvian government officials initially resisted calls to hand over Calovskis, saying US plans to sentence him to more than 60 years in jail did not represent "proportionate punishment".
A plea agreement on sentencing reached with lawyers representing Calovskis means he will not appeal against any jail sentence of two years or less.
It is not clear whether the 10 months Calovskis spent in jail in Latvia during the extradition row will count as part of the sentence he eventually receives.
He is scheduled to be sentenced on 14 December.
Two other men have been arrested in connection with the creation and administration of Gozi.
Russian national Nikita Kuzmin is in jail in the US following his arrest in May 2011 on separate hacking and fraud charges.
Extradition proceedings against Romanian Mihai Ionut Paunescu are currently on hold pending an appeal.
A Latvian man has pleaded guilty to creating malware that stole millions of dollars from online bank accounts.