Authorities arrested 354 suspects in a multinational law enforcement campaign that targeted vendors and buyers on several major dark web marketplaces, officials said.
Operation TorNado: scope, timeline, and targets
Codenamed Operation TorNado, the action ran from May 2025 to October 2026 and involved agencies from 14 countries. Authorities said the operation focused on vendors and buyers active on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom marketplaces, and also targeted activity on forums, single-vendor shops, and encrypted messaging services. National authorities conducted independent investigations with support from Europol, including cross-checks via SIENA and forensic analysis, Europol said.
Seizures and arrests in Europe and the United States
Law enforcement reported heavy seizures on both sides of the Atlantic. In Europe, authorities seized over €60 million in cash and cryptocurrency, 950 kilograms of illicit drugs — explicitly including amphetamines, cocaine, ketamine, psilocybin mushrooms, MDMA, and cannabis — and 57 firearms. In the United States, authorities seized more than 4.8 metric tonnes of illicit drugs, 152 firearms, and over €150 million (reported as $166 million).
The United States Department of Justice described the investigations as complementary but distinct: "Following the takedown of multiple darknet marketplaces and vendor targets in the previous JCODE operation, U.S. and international law enforcement agencies obtained intelligence to identify Dark Web drug traffickers, resulting in a series of complementary, but separate, law enforcement investigations," the DOJ said. The department added that "by leveraging complementary partnerships and surging resources across the U.S. government and Europol, Operation TorNado significantly disrupted the online opioid trade and sends a strong message that criminals operating on the Dark Web are not beyond the reach of law enforcement."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildInvestigative methods and international coordination
Europol noted the use of established coordination tools and forensic methods: national authorities performed independent probes while Europol supported cross-checking via SIENA and forensic analysis. The investigation model included direct action against marketplace infrastructure — multiple named markets were listed — as well as parallel targeting of vendor storefronts, forum activity, and encrypted messaging channels. Europol summarized an operational reality: "The operation highlighted the evolving resilience of dark web marketplaces, which continue to adapt despite takedowns."
How technologists, policymakers, and the general public are responding
- Technologists and security teams: The Europol finding about “evolving resilience” underscores that takedowns will not be one-time fixes. Teams responsible for digital investigations, forensic analysis, and platform-level abuse monitoring will likely need to maintain or increase capabilities to track marketplace migration from indexed markets to forums, single-vendor shops, and encrypted channels.
- Policymakers and regulators: The large cross-border seizures of cash, cryptocurrency, drugs, and firearms — and the DOJ’s emphasis on complementary U.S.-European investigations — signal sustained international cooperation. Regulators and budget managers will be watching whether the surge in resources cited by the DOJ continues and how it’s coordinated across national lines.
- The general public: Authorities framed part of the operation as a disruption to the online opioid trade. The scale of drug and weapon seizures reported in both Europe and the U.S. may affect local enforcement priorities and public messaging about organized online drug trafficking.
Operation TorNado is the latest in a series of multinational actions against the darknet. Past efforts cited by law enforcement include DisrupTor in 2020 (179 arrests), Dark Huntor in 2021 (150 high-volume vendor arrests), the April 2022 takedown of the Hydra marketplace (more than 19,000 seller accounts serving over 17 million customers, according to authorities), Operation SpecTor in 2023 (288 arrests and €50.8 million seized), and Operation RapTor in May 2025 (270 arrests across ten countries). Together these operations illustrate a pattern: repeated takedowns and follow-up investigations produce significant seizures and arrests, while law enforcement agencies continue to note the capacity of marketplaces to adapt.
For now, the record of Operation TorNado is plain: 354 arrests, large seizures of money, drugs, and firearms on both continents, and a continued emphasis by Europol and the U.S. Department of Justice on coordinated, complementary investigations. Whether that coordination will deliver a durable interruption of darknet trafficking — or simply another stage in an evolving cycle of takedowns and marketplace adaptation — is the central question left by the operation’s results.
