Law enforcement agencies from 14 countries have arrested 354 suspected vendors and buyers linked to major dark web marketplaces in an international operation coordinated by Europol. The operation, named TorNado, also resulted in hundreds of searches and the seizure of substantial quantities of drugs, firearms, cash and cryptocurrency.
Europol announced the results on November 12, describing the operation as a coordinated effort to disrupt criminal networks operating through dark web marketplaces, online forums and encrypted messaging services.
Five Major Marketplaces Targeted
The investigation focused on individuals associated with five major dark web marketplaces: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. Authorities also targeted vendors and buyers using single-vendor shops, online forums and encrypted communication channels.
The operation ran from May 2025 to October 2026 and involved investigators across Europe, North America and the Asia-Pacific region. Europol supported the participating agencies through intelligence sharing, forensic analysis and coordination between national investigations.
The United States recorded 132 arrests, while the United Kingdom reported 59 and Hungary 45. Germany reported 41 arrests, and France recorded 23.
Cryptocurrency and Financial Investigations Played a Role
The operation also involved tracing financial transactions connected with suspected criminal activity. Europol said its blockchain analysis teams helped trace illicit transactions and uncover evidence linked to dark web networks.
Authorities in European countries seized more than €60 million in cash and cryptocurrency, alongside 950 kilograms of illicit drugs and 57 firearms. US authorities reported additional seizures, including more than 4.8 metric tonnes of drugs, 152 firearms and over $166 million in cash and cryptocurrency.
The financial seizures demonstrate how digital-asset tracing can support investigations into criminal marketplaces, even when transactions are conducted through complex online networks.
Criminal Networks Continue to Adapt
Europol said the operation highlighted the ability of dark web criminal networks to reorganise after major marketplace disruptions. Investigators have observed increasingly fragmented platforms, specialised marketplaces and the use of encrypted messaging services alongside dark web infrastructure.
The agency’s findings suggest that shutting down one marketplace does not necessarily eliminate the networks behind it. Vendors and buyers may migrate to replacement platforms or use different communication channels.
The operation represents a significant enforcement effort, but authorities are expected to continue pursuing suspects and examining evidence gathered during the investigations.
This website uses cookies.