Operation TorNado Leads to 354 Arrests After Darknet Market Investigation
Europol and the U.S. Department of Justice announced the results of the international Operation TorNado. The investigation followed earlier actions against darknet markets.
Operation TorNado led to 354 arrests in the United States, Europe, Australia and New Zealand, according to Europol and the U.S. Department of Justice. Authorities announced the results of the coordinated investigation into darknet vendors and buyers on November 12, 2026.
The operation ran from May 2025 through October 2026. It targeted the trade in drugs and other illegal goods on the darknet. It was not primarily an action against the internet’s technical infrastructure or the disclosure of a new security vulnerability.
Operation TorNado Followed the Seizure of Darknet Markets
The investigations were based on data obtained during earlier seizures of the Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door darknet markets. According to Europol, authorities targeted not only these markets but also related forums, independent storefronts and encrypted communication services.
This approach shows the practical value of data obtained when online marketplaces are dismantled: it can support follow-up investigations into individual accounts and their users across multiple countries. The U.S. Department of Justice said some investigations are still ongoing to identify additional people behind darknet accounts.
Authorities Report Different Seizure Totals
Europol reported the seizure of approximately five tons of drugs and more than €210 million in cash and cryptocurrency. The U.S. Department of Justice’s summary lists approximately 5.7 tons of drugs, 209 weapons and more than $234 million.
The different figures may reflect different reporting methods. However, the available statements do not make clear why Europol’s and the U.S. Department’s totals differ on some items.
The discrepancy also concerns part of the geographic breakdown of arrests. Europol reports one arrest in Australia and activity in Montenegro without an arrest. The U.S. Department of Justice, by contrast, reports two arrests in Australia and does not mention Montenegro in its overview. Both institutions nevertheless confirmed a total of 354 arrests.
What the Operation’s Results Mean—and What Is Not Yet Clear
An arrest or the filing of charges does not mean that a specific person has been convicted. Details of the individual cases will therefore need to be assessed based on published indictments and court filings.
It is also not confirmed to what extent the operation will limit drug trading on the darknet over the long term. Europol warned that actors may quickly move to replacement platforms. Operation TorNado therefore represents a follow-up investigative phase after the closure of several marketplaces, not the definitive removal of this type of illegal trade.
What to Watch After Operation TorNado
- the publication of specific indictments, court filings and the identities of key suspects,
- clarification of discrepancies in Europol and U.S. Department of Justice data, particularly regarding Australia and Montenegro,
- additional arrests or seizures resulting from ongoing investigations.
Sources
- Europol – Confirms the operation’s name, timeframe, 354 arrests, participation by 14 countries, the connection to five previously seized markets, and European data on seized assets and drugs.
- U.S. Department of Justice – Confirms U.S. participation through JCODE, the total of 354 arrests, global seizures, the focus on drug trafficking and the continuation of some investigations.
- BleepingComputer – Independently summarizes the recent announcement and its connection to darknet markets.
Verified and updated: November 13, 2026 15:26
