The United States Department of Justice (DOJ) and Europol announced on November 12 that Operation TorNado resulted in 354 arrests and the seizure of more than $234 million in cash and cryptocurrency, marking the largest international takedown of dark web drug vendors and buyers to date.
The operation ran from May 2025 to October 2026 and involved law enforcement agencies in 14 countries. The United States recorded 132 arrests, followed by the United Kingdom with 59, Hungary with 45, Germany with 41, and France with 23. Authorities also seized approximately 5.7 metric tons of drugs, 209 firearms, and 38 pill presses. Officials did not disclose how much of the $234 million was in cryptocurrency alone, while Europol reported more than €210 million in seized criminal assets.
Operation TorNado was the sixth and largest effort by the U.S. Justice Department's Joint Criminal Opioid and Darknet Enforcement team since 2018. It built on the 2025 Operation RapTor and on evidence from previously dismantled markets including Bohemia, Nemesis, Kingdom, Tor2Door, and Archetyp. The latest operation also targeted vendors and buyers linked to DrugHub and Archetyp.
Attorney General Todd Blanche said the crackdown had crippled dark web market vendors, while FBI Director Kash Patel called it the largest interagency takedown of dark web drug vendors and buyers to date.
Investigators used leads from prior marketplace takedowns to link anonymous accounts to real people, and Europol said European countries carried out separate investigations using shared intelligence and forensic analysis. Neither agency claimed investigators broke Monero's cryptography, and Europol's 2026 Internet Organised Crime Threat Assessment noted that privacy coins and offshore exchanges make illicit funds harder to trace.
Despite the enforcement action, darknet market activity has shown resilience. Chainalysis estimated that darknet markets and drug vendors received slightly over $2.5 billion in crypto in 2025, up modestly from 2024. TorZon gained ground after Abacus Market closed in July 2025. TRM Labs found that 48 percent of darknet markets launched in 2025 accepted only Monero, and Monero activity remained above pre-2022 levels despite exchange restrictions. The FATF's July 2026 update warned of risks from providers operating without effective oversight. For exchanges and compliance teams, larger seizures alone do not prove that underlying illicit trade has shrunk.
