Ing. Calogero Bono
The US Department of Justice, through the JCODE team, announced together with Europol the results of Operation TorNado. There have been 354 arrests of drug sellers and buyers on dark web marketplaces, across the United States, Europe, Australia and New Zealand. According to the authorities, over 234 million dollars in cash and cryptocurrency were seized. It matters because it shows how shutting down an illegal market fuels the investigations that follow.
A few terms, before we get into the facts. Dark web refers to sites reachable only with dedicated software, in this case the Tor network. Marketplace is an online market where sellers and customers trade goods, in this case illegal ones. JCODE is the American team created in 2018 against opioids and darknet markets. Europol is the European agency that coordinates police forces. SIENA is the information-exchange channel that Europol cites for cross-checks.
What is Operation TorNado?
It is a coordinated action across several agencies, described by the Department of Justice as the sixth international operation since JCODE was created in 2018 and the largest. According to the official source it ran from May 2025 to October 2026.
It stems from the closure of markets such as Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. The information gathered made it possible to link anonymous accounts to real people. Punto Informatico reports the participation of 14 countries.
How many arrests and seizures were there?
There were 354 arrests. The Department of Justice counts 132 in the United States, 59 in the United Kingdom, 45 in Hungary and 41 in Germany.
The seizures declared by the US amount to over 234 million dollars, about 5.7 tons of drugs, 38 pill presses and 209 firearms.
For Europe, BleepingComputer reports over 60 million euros, 950 kilograms of drugs and 57 weapons. In the United States, 4.8 tons and 152 weapons.
Which cases have been made public?
The Department of Justice cites several proceedings. Two brothers arrested in Florida allegedly ran the seller "BarbaraWhite", selling counterfeit pills containing nitazenes, synthetic opioids. According to the prosecution they shipped over a thousand packages to 49 states.
Another case concerns Alexander Green, accused of running the seller "STARLABS" on the Drughub market, linked to two overdose deaths in Ohio. These are charges, not convictions. If convicted, the brothers face up to 20 years in prison.
How does it fit with previous operations?
According to BleepingComputer, DisrupTor in 2020 led to 179 arrests. SpecTor in 2023 to 288 and RapTor in May 2025 to 270. In 2022 Hydra, at the time the largest darknet market, was shut down.
The trend is clear. The authorities use data from seized markets to target those who frequented them. Europol, cited by the same outlet, admits that marketplaces "continue to adapt" despite the closures. Those interested in stolen data can also read about the case of data sold on the dark web.
Limits to know
The numbers are declared by the authorities and not independently verified. The figures from Europol and the Department of Justice use different scopes, so they should not be added together lightly. Many investigations are still ongoing to identify the people behind the accounts. The defendants named are presumed innocent until sentenced.
What changes for those working in digital
For those working in digital, little changes in the short term, but the message is useful. Network anonymity is not a guarantee, and the data from a seized service can resurface years later. Anyone running online platforms must keep logs and respond to legal requests under clear rules. Anyone building payments or e-commerce should know that cryptocurrency tracing is a concrete investigative tool, as IRS-CI reminds us. Companies also suffer scams and credential theft sold on the same markets, so it is worth keeping servers up to date.
Our take
The operation is a significant result, but it should be read with caution. The press releases use political tones and aggregate figures that are hard to check. The most interesting point is technical – shutting down a market becomes the source for the investigations that follow. There remains, however, Europol's admission about the markets' ability to adapt, which suggests a long struggle rather than a definitive victory.
Frequently asked questions
How many people were arrested in Operation TorNado?
There were 354 in total. Of these, 132 in the United States, 59 in the United Kingdom and 45 in Hungary, according to the Department of Justice.
Which marketplaces were hit?
Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door, already shut down by the authorities. DrugHub and other markets where the sellers operated are also mentioned.
How long did the operation last?
From May 2025 to October 2026, according to the official source. Some investigations remain open.
How many countries took part?
There were 14, according to Punto Informatico and BleepingComputer. Among them the United States, Germany, France, the United Kingdom and Italy do not appear in the list.
What was seized?
Over 234 million dollars in cash and cryptocurrency, about 5.7 tons of drugs and 209 firearms. These are figures declared by the authorities.
What to watch after the arrests, between trials and new markets
The coming weeks will show how well the charges hold up and where the traffic moves. It is worth following three signals.
- Follow the outcome of the trials in American courts, starting with the cases named in the press release.
- Check whether Europol publishes separate data by country, useful for verifying the totals.
- Watch for the emergence of new marketplaces or forums after the closure of those mentioned.
