Operation TorNado Leads to 354 Arrests Across 14 Countries

The US Department of Justice and Europol say Operation TorNado has led to the arrest of 354 dark-web vendors and buyers across 14 countries, in a follow-up to earlier marketplace takedowns rather than a new shutdown of the markets themselves. Both organisations announced the results on 12 November 2026. The Justice Department describes the arrests as of “Dark Web drug traffickers and fraudulent criminals who engaged in tens of thousands of sales of illicit goods and services across the United States, Europe, Australia, and New Zealand.” Arrests are not convictions; the department notes that an indictment or complaint “merely alleges that crimes have been committed” and that defendants “are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.”

The action matters because it is aimed at people who kept trading after the markets came down. The Justice Department says Operation TorNado “included actions against Dark Web vendors and buyers who were active on prominent Dark Web drug markets seized by law enforcement including: Archetyp, Bohemia, Nemesis, Kingdom, and Tor2Door.” It also names DrugHub among markets on which vendor accounts were identified. Europol likewise calls the work “a follow-up action focused on the identification of suspects after the takedown of five major dark marketplaces,” listing the same five names, and says investigators also looked at forums, single-vendor shops and encrypted messaging services.

Seizure figures are kept with each source

The Justice Department and the FBI give one set of totals; Europol gives another. They should not be added together or converted into a single number. The department says the operation resulted in “the seizure of over $234 million in both cash and virtual currencies; approximately 5.7 metric tons of illicit drugs worldwide, including fentanyl and other opioids, methamphetamine, heroin, cocaine, ecstasy, and MDMA, 38 pill presses; and 209 firearms.” The FBI’s account of the same announcement also cites more than $234 million and more than 5.7 metric tons, and, separately, reports United States totals of 132 arrests, approximately 4.8 metric tons of illicit drugs, more than $166 million in cryptocurrency and cash, 152 firearms and 38 pill presses. It says more than 354 kilograms of the drugs seized consisted of fentanyl and/or fentanyl-laced pills.

Europol’s headline figure is “5 tonnes of drugs and over EUR 210 million in criminal assets.” In European countries, it says, authorities seized 950 kilograms of illicit drugs, 57 firearms and ammunition, and over EUR 60 million in cash and cryptocurrencies. For the United States, Europol reports over 4.8 metric tonnes of illicit drugs, 152 firearms, and over EUR 150 million (USD 166 million) seized in cash and cryptocurrencies. Those are Europol’s figures, in Europol’s units.

The FBI and Europol both date the operation from May 2025 through October 2026. The Justice Department calls it “the sixth — and most extensive — internationally coordinated action since JCODE was created in 2018,” and says it builds on last year’s Operation RapTor. JCODE, the Joint Criminal Opioid and Darknet Enforcement team, is described as an FBI-led Justice Department initiative. The FBI says that when illegal markets are disrupted or taken down, investigators analyse the data to identify users and share leads with partners. Both the department and the FBI say investigations remain under way in several countries to identify more people behind anonymous accounts.

Operation TorNado’s country counts, and the UK figure

On arrests by country, the Justice Department and Europol agree on most of the table, including 132 in the United States and 59 in the United Kingdom. Europol names the National Crime Agency and the National Police Chiefs’ Council as the UK participants. The two official accounts diverge on Australia: the department and the FBI report two arrests there, while Europol’s table lists one. That difference is left as a difference between the sources. Europol also records a Finnish footnote of 159 interrogations in addition to one arrest, and a “knock and talk” in Montenegro that is not counted in the 354.

Firearms appear in the official tallies and are recorded here as part of those tallies, credited to each source as above. They are not the focus of the operation as the agencies describe it, which is the identification of vendors and buyers on already seized markets, and the disruption of online opioid and other illicit sales.

A separate TSN account of a dark-web market case is the sentencing of an Empire Market co-creator, a different marketplace and a conviction, not part of Operation TorNado. Europol has also been coordinating other cyber-crime actions, including Operation Endgame’s recent server takedowns. Italy’s foreign minister, Antonio Tajani, has separately sought G7 talks after personal data appeared on the dark web, a different incident from this vendor-and-buyer crackdown.

The limits of the 354-arrest figure

The 354 figure is an arrest total, announced jointly in outline but tallied with care in the official releases. It is not a count of people found guilty, and it is not a claim that the named markets were taken down in this operation. The markets, on the agencies’ own wording, had already been seized; this phase was about identifying the people who had used them, and others still trading on forums and messaging services.

The seizure numbers are likewise not interchangeable. Over $234 million and approximately 5.7 metric tons sit with the Justice Department and the FBI. Over EUR 210 million and 5 tonnes sit with Europol. The US sub-totals also line up more closely than the global headlines: both the FBI and Europol put American drug seizures at about 4.8 metric tons, and both give 152 firearms in the United States, while Europol states the US money figure as over EUR 150 million and, in parentheses, USD 166 million, which matches the FBI’s “more than $166 million.” Converting the remaining European and global totals into a single currency, or folding them into the department’s $234 million, would invent a number neither source published.

What comes next is the unfinished investigative work. The FBI and the Justice Department say cases are still open in several countries. Europol, for its part, points to a familiar pattern from its 2026 Internet Organised Crime Threat Assessment: markets fragment, forums and encrypted chat blur into the trade, and new platforms replace those that have been taken down. The test of Operation TorNado will be whether the identifications made after those earlier seizures can be carried through the courts, country by country.

Sources

• US Department of Justice, 12 November 2026. “International Law Enforcement Operation Targeting Opioid and Fentanyl Traffickers on the Dark Web Results in over 350 Arrests Worldwide and the Seizure of Drugs, Weapons, and over $234 Million.”
• FBI, 12 November 2026. “Operation TorNado Leads to More Than 350 Arrests Across 14 Countries.”
• Europol, 12 November 2026. “354 dark web vendors and buyers arrested in Europol-coordinated global crackdown.”

Related stories

• Empire Market Co-Creator Gets 40 Years, Agrees to Forfeit 1,230 BTC is the nearest TSN account of a completed dark-web market prosecution, a different case from Operation TorNado.
• Operation Endgame Takes Down Gootloader, CastleRAT and StealC
• Tajani Seeks G7 Talks After Personal Data Appears on Dark Web