An international operation targeting alleged drug dealing and other crime on the dark web led to 354 arrests, including 59 in the United Kingdom, authorities have announced.
Operation TorNado brought together law enforcement agencies from 14 countries. Its results, announced on 12 November, cover investigations and enforcement activity from May 2025 to October 2026 rather than a single day of arrests.
Authorities reported 132 arrests in the United States, 45 in Hungary, 41 in Germany and 23 in France, alongside the UK figure. There were also arrests in New Zealand, the Netherlands, Slovenia, Austria, Ireland, Czechia, Australia and Finland. The number of participating countries is not the same as the number of countries in which arrests were reported.
The US Department of Justice said the operation resulted in the seizure worldwide of approximately 5.7 tonnes of illicit drugs and more than $234 million in cash and virtual currencies. It also reported 209 firearms and 38 pill presses seized. The drugs included fentanyl and other opioids, methamphetamine, heroin, cocaine and MDMA.
What was seized in Europe and the US
In European countries, officers seized a total of 950 kilograms of illicit drugs, according to Europol. The agency said this included 150 kilograms of ketamine in the UK and 150 kilograms of amphetamines in Germany. Other seizures included 40 kilograms of MDMA in the Netherlands and 50 kilograms of cannabis in France.
European authorities also seized more than one million prescription tablets, along with 57 firearms and ammunition. More than €60 million in cash and cryptocurrencies was recovered in Europe, the agency reported.
In the US, the reported seizures included more than 4.8 tonnes of illicit drugs, 152 firearms and more than $166 million in cash and cryptocurrencies. Those figures form part of the wider operation totals, not an additional set to be added to them.
How the investigations developed
The operation followed earlier seizures of dark web marketplaces, including Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. Investigators used information obtained after marketplace takedowns to pursue separate cases involving suspected sellers and buyers.
Authorities also investigated activity on forums, single-vendor shops and encrypted messaging services. Europol supported national investigations with information-sharing, forensic work and analysis of cryptocurrency transactions, and deployed staff to assist operations in Czechia and Slovenia.
The US contribution included the Joint Criminal Opioid and Darknet Enforcement team, an FBI-led initiative established in 2018. The team brings together agencies with different responsibilities, including the investigation of drugs, financial transactions and the use of postal services.
One US case highlighted by the Justice Department concerns two brothers arrested in Florida and charged in Virginia with conspiracy to distribute synthetic opioids. Authorities allege that the pair operated an online vendor selling counterfeit oxycodone pills containing nitazenes. The allegations have not been presented as findings of guilt.
In another case, US investigators linked an alleged online vendor based in North Carolina to two suspected overdose deaths in Ohio. A search connected with the investigation recovered methamphetamine and more than two kilograms of counterfeit pharmaceutical pills containing fentanyl, authorities said. The defendant faces drug charges.
An arrest or charge is not a conviction. The Justice Department has said that indictments and criminal complaints are allegations, and defendants are presumed innocent unless proven guilty in court. It also said investigations were continuing to identify people behind other online accounts.
An international series of operations
TorNado follows Operation RapTor in 2025, when authorities reported 270 arrests across ten countries. Both involved follow-up investigations using information associated with previously seized marketplaces. The newer operation drew in agencies from a wider group of countries and produced a separate set of reported results.
Europol has warned that dark web markets continue to adapt after takedowns. Its assessment points to a more fragmented landscape, with activity spread across specialised platforms as well as forums and encrypted services. The continuing investigations mean the announced figures are an account of the operation so far, rather than a final judgment on every case.
