DOJ and Europol report 354 arrests in Operation TorNado

What happened

The U.S. Justice Department and Europol announced Thursday that Operation TorNado produced 354 arrests and seized more than $234 million in cash and virtual currencies. The FBI called it the largest takedown to date of dark web drug vendors and buyers. The announcement came from the Joint Criminal Opioid and Darknet Enforcement team, or JCODE, an FBI-led group created in 2018.

The operation unfolded between May 2025 and October 2026 and was the sixth and most extensive internationally coordinated action since JCODE was formed, officials said. It builds on last year's Operation RapTor. Europol coordinated with agencies in 14 countries. It focused on vendors and buyers active on five dark web markets already seized by law enforcement: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. Officials also identified accounts on DrugHub, forums, single-vendor shops and encrypted messaging services.

The arrest tally was 132 in the United States, 59 in the United Kingdom, 45 in Hungary and 41 in Germany, with others in France, New Zealand, the Netherlands, Slovenia, Austria, Ireland, Czechia, Australia and Finland. Investigations continue into remaining dark web accounts.

Why it matters

FBI Director Kash Patel called Operation TorNado "the largest interagency takedown of Dark Web drug vendors and buyers to date," Bitcoin Magazine reported. Yet the official totals do not specify how much of the seized money was cryptocurrency.

What the data shows

Europol put the European share at more than €60 million in cash and cryptocurrencies, along with 950 kilograms of drugs and 57 firearms. Those regional figures still combine cash and crypto. Blockonomi reported that Chainalysis Reactor analysis mapped a BarbaraWhite wallet cluster that received about $220,000 from darknet marketplaces and sent about $230,000 in cryptocurrency to recipients including a postage service, another drug vendor and a China-based chemical supplier.

Background

JCODE was created in 2018. Operation TorNado follows last year's Operation RapTor and targeted markets that had already been seized. The department highlighted two cases. Alexander Green, 32, of Jacksonville, North Carolina, was charged in the Southern District of Ohio with conspiracy to distribute controlled substances, including fentanyl. Officials said he allegedly ran STARLABS on DrugHub, described as a Monero-only market, and that the group has been linked to two overdose deaths. Prosecutors say they allegedly ran "BarbaraWhite," selling counterfeit oxycodone pills laced with nitazenes. An affidavit describes bitcoin transfers tied to that account and the Nemesis market.

What is still unclear

Officials have not said how much of the $234 million was cryptocurrency, or how much of that was bitcoin. The record shows a combined cash-and-crypto seizure, a Monero-only market in at least one featured case and bitcoin transfers in court papers, but no breakdown of the total. The regional totals do not resolve the question because they also combine cash and virtual currencies.

What to watch

The Justice Department said investigations are ongoing to identify the people behind remaining dark web accounts. Federal prosecutions are underway in more than 20 districts. The department noted that an indictment or complaint only alleges crimes and that defendants are presumed innocent until proven guilty.

Questions readers ask