Police arrest 354 drug sellers and buyers from dark web markets that had already shut down
Police in 14 countries have arrested 354 people who sold or bought drugs on dark web markets, Europol and the US Justice Department announced on 12 November. According to Help Net Security, Operation TorNado ran from May 2025 to October 2026 and went after people who had traded on five markets that were already offline: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. Police were still finding customers of these sites months and years after the sites themselves went dark.
In short
- Both vendors and buyers were arrested, and police carried out hundreds of house searches.
- More than €210 million in cash and cryptocurrency was seized, along with more than 5.7 tonnes of drugs and over 200 firearms.
- The US Justice Department says more investigations are still under way to identify people behind dark web accounts.
Where the arrests happened
More than a third of the arrests were in the United States. In Finland, police made one arrest and questioned 159 people.
| Country | Arrests |
|---|---|
| United States | 132 |
| United Kingdom | 59 |
| Hungary | 45 |
| Germany | 41 |
| France | 23 |
| New Zealand | 13 |
| Netherlands | 12 |
| Slovenia | 11 |
| Austria | 6 |
| Ireland | 5 |
| Czechia | 4 |
| Australia | 2 |
| Finland | 1 |
In the US, police seized more than 4.8 tonnes of drugs, 152 firearms and over €150 million in cash and crypto. In Europe they found 950 kg of drugs, 57 firearms, more than a million prescription pills and over €60 million. The Epoch Times reports that the Justice Department called it the sixth and largest operation of its JCODE darknet team since the team was set up in 2018. One of the US suspects, a 35-year-old man from California, allegedly ran a dark web drug shop from his home, where agents found methamphetamine, heroin, cocaine, fentanyl and carfentanil.
Why closed markets still lead to arrests
When police take a dark web market down, they usually seize its servers too, and with them records of orders, messages and payments. Europol has not said exactly how the TorNado suspects were identified. It says its blockchain analysts traced the illegal payments and that it coordinated national cases so that two countries did not chase the same suspect. The previous operation, RapTor, relied on intelligence gathered in the earlier takedowns of Nemesis, Tor2Door, Bohemia and Kingdom.
Tor hides where a visitor connects from, but it does not protect what the person leaves on the market itself: delivery addresses, chat logs and cryptocurrency transactions, which stay on the blockchain for good. Once the market's database is in police hands, a buyer can be traced through these traces long after the site is gone.
Taking down markets does not end the trade. TorNado follows earlier Europol operations RapTor (2025), SpecTor (2023), Dark HunTor (2021) and DisrupTor (2020). Europol's 2026 organised internet crime assessment notes that closed markets are quickly replaced by new ones, and that the trade is splitting into smaller sites that each focus on one kind of crime.
