Dark Web Crackdown: 354 Arrested in 14 Countries – Operation TorNado

An international law enforcement operation targeting illegal dark web marketplaces has resulted in 354 arrests across 14 countries. Known as Operation TorNado, the coordinated crackdown targeted suspected drug traffickers, weapons dealers, and individuals involved in other forms of cyber-enabled organized crime. Authorities also seized several tons of illegal drugs, hundreds of firearms, and assets worth more than €210 million.

Operation TorNado: Major International Crackdown on Dark Web Crime

International law enforcement agencies have carried out one of the largest coordinated operations against criminal networks operating on the dark web. According to Europol, Operation TorNado resulted in 354 arrests across 14 countries, with hundreds of searches conducted worldwide.

The results were announced on November 12, 2026, following an investigation that lasted approximately 18 months, from May 2025 to October 2026.

Authorities from the United States, Germany, the United Kingdom, France, the Netherlands, and several other countries worked together to identify suspected vendors and buyers involved in illegal activities on dark web marketplaces.

The operation primarily targeted the distribution of illegal drugs, including fentanyl and other dangerous synthetic opioids, as well as firearms-related offenses and organized cybercrime.

354 Arrests Worldwide: Germany, the US and UK Among the Countries Involved

Operation TorNado led to hundreds of arrests across multiple continents, highlighting the international scale of criminal networks operating through anonymous online marketplaces.

The United States recorded the highest number of arrests, with 132 suspects detained. The United Kingdom followed with 59 arrests, while Hungary reported 45 and Germany recorded 41.

France, the Netherlands, Austria, and several other European countries also participated in the crackdown.

According to Europol, the arrests were distributed as follows:

Montenegro also participated in the international operation, conducting a so-called "knock and talk," a law enforcement technique in which officers visit a residence and request to speak with its occupants.

Finnish authorities conducted 159 interrogations in addition to one arrest.

Editor's note: The individual country figures published by Europol add up to 353 arrests, although the agency officially reports 354. The FBI separately lists two arrests in Australia, which would account for the difference.

More Than €210 Million in Criminal Assets Seized

In addition to the arrests, authorities confiscated significant quantities of illegal drugs, firearms, cash, and cryptocurrencies.

According to Europol, approximately 950 kilograms of illegal drugs were seized across European countries.

Among the largest seizures were:

• Germany: approximately 150 kilograms of amphetamines.

• United Kingdom: approximately 150 kilograms of ketamine.

• Netherlands: approximately 40 kilograms of MDMA.

• France: approximately 50 kilograms of cannabis.

Investigators also recovered cocaine, psilocybin mushrooms, THC-containing vaping products, and more than one million prescription tablets.

In the United States, authorities seized more than 4.8 metric tons of illegal drugs, bringing the worldwide total to approximately 5.7 metric tons.

The operation also resulted in the confiscation of 209 firearms, including 57 in Europe and 152 in the United States.

Financial seizures were equally significant. Authorities recovered more than €210 million in cash and cryptocurrencies, equivalent to approximately $234 million.

The scale of these seizures demonstrates the substantial financial resources associated with illegal dark web trading networks.

Major Dark Web Marketplaces Targeted by Investigators

A key element of Operation TorNado was the analysis of evidence collected during previous law enforcement operations against major dark web marketplaces.

Investigators focused on vendors and buyers who had operated on five previously dismantled platforms:

• Archetyp

• Bohemia

• Nemesis

• Kingdom

• Tor2Door

These marketplaces had been used to facilitate illegal transactions, particularly involving controlled substances.

Although the platforms had already been shut down, information obtained during earlier investigations continued to provide valuable leads.

Law enforcement agencies used this evidence to identify individuals suspected of participating in illegal transactions, including sellers and customers who may have believed their online activities could no longer be traced.

Investigators also examined criminal activity involving internet forums, independent vendor websites, and encrypted messaging platforms.

The operation demonstrates that shutting down a dark web marketplace does not necessarily mark the end of an investigation. Evidence recovered from seized infrastructure can continue to support criminal investigations long after a platform disappears.

How Did Authorities Identify Anonymous Dark Web Users?

One of the most important aspects of Operation TorNado was the ability of investigators to connect anonymous online identities with individuals in the real world.

Dark web marketplaces often rely on anonymity technologies, including the Tor network, encrypted communications, and cryptocurrency payments.

However, these technologies do not automatically guarantee that criminal activity cannot be investigated.

During Operation TorNado, law enforcement agencies combined digital forensic evidence, financial investigations, intelligence sharing, and traditional investigative techniques.

Europol supported participating countries by coordinating information exchanges and providing specialized forensic and blockchain analysis.

Investigators examined cryptocurrency transactions and compared information collected from multiple investigations to identify connections between suspected criminal networks.

Although cryptocurrency transactions can be difficult to investigate, certain blockchain records may provide useful evidence when combined with information obtained from exchanges, seized devices, or other sources.

The operation highlights how digital evidence and international cooperation can help authorities identify individuals suspected of operating behind anonymous online accounts.

Europol, FBI and German Authorities Worked Together

International cooperation played a central role in the success of Operation TorNado.

Europol coordinated intelligence sharing and supported national investigations, while several major law enforcement organizations contributed resources and expertise.

In the United States, participating agencies included the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration (DEA), and other members of the Joint Criminal Opioid and Darknet Enforcement initiative, commonly known as JCODE.

German authorities involved in the operation included the Federal Criminal Police Office (BKA), the General Prosecutor's Office in Frankfurt am Main, specialized cybercrime units, and various regional police and customs investigation departments.

The United Kingdom's National Crime Agency (NCA) and law enforcement agencies from other participating countries also contributed to the investigations.

Operation TorNado followed several previous international actions targeting criminal dark web activity, including DisrupTor in 2020, Dark Huntor in 2021, SpecTor in 2023, and RapTor in 2025.

These operations demonstrate an ongoing strategy of targeting not only marketplace operators but also vendors, buyers, and the financial infrastructure supporting illegal transactions.

Dark Web Marketplaces Continue to Evolve Despite Takedowns

Despite the large number of arrests and significant seizures, authorities acknowledge that criminal activity on the dark web remains a persistent challenge.

According to Europol, illegal online marketplaces continue to adapt following law enforcement disruptions.

While large centralized marketplaces once dominated much of the underground economy, criminal activity is increasingly spreading across smaller platforms and alternative communication channels.

Some vendors have moved toward independent online stores, specialized marketplaces, and encrypted messaging services.

This fragmentation makes it more difficult for investigators to identify and dismantle entire criminal networks through a single enforcement action.

When a major marketplace is shut down, users may migrate to existing alternatives or establish new platforms.

As a result, law enforcement agencies increasingly focus on identifying individuals and criminal organizations rather than relying exclusively on marketplace takedowns.

Operation TorNado illustrates this approach by targeting suspected vendors and buyers connected to platforms that had already been dismantled.

What Does Operation TorNado Mean for the Future of the Dark Web?

The international crackdown demonstrates that criminal investigations involving the dark web are becoming increasingly coordinated and technically sophisticated.

Authorities are no longer focusing exclusively on the administrators of illegal marketplaces. Investigations can also target sellers, buyers, financial intermediaries, and other individuals suspected of supporting criminal activities.

Another important aspect is the long-term value of digital evidence.

Information collected during a marketplace seizure may remain useful for months or even years, potentially allowing investigators to identify additional suspects long after a website has been taken offline.

However, it is important to distinguish between the dark web itself and criminal activities conducted through it.

The Tor network and other privacy-enhancing technologies also serve legitimate purposes, including protecting personal privacy, bypassing internet censorship, and enabling secure communication for journalists, activists, and whistleblowers.

Operation TorNado specifically targeted suspected criminal conduct rather than the general use of anonymity technologies.

Conclusion: One of the Largest International Dark Web Crackdowns

With 354 reported arrests across 14 countries, more than €210 million in seized assets, approximately 5.7 metric tons of confiscated drugs, and 209 firearms recovered, Operation TorNado represents one of the most extensive coordinated law enforcement actions against illegal dark web trading networks.

The operation highlights the increasing importance of international intelligence sharing, cryptocurrency investigations, and digital forensic analysis in combating cyber-enabled organized crime.

It also demonstrates that the shutdown of a dark web marketplace does not necessarily protect former vendors or buyers from future investigations.

Whether Operation TorNado will produce a lasting reduction in illegal dark web activity remains uncertain.

Previous enforcement actions have shown that criminal networks frequently reorganize and migrate to alternative platforms following major takedowns.

Nevertheless, the scale of Operation TorNado sends a clear message: anonymous online marketplaces are not beyond the reach of international law enforcement.