Dark web arrests 2026: how 354 suspects lost their anonymity

Operation TorNado is an international sweep that ran from May 2025 until October 2026, roughly a year and a half of work. It was led in the US by JCODE, an FBI-run unit whose name stands for Joint Criminal Opioid and Darknet Enforcement, working with police from 13 other countries in Europe plus Australia and New Zealand.

Here is how the arrests break down where officials gave figures:

• United States: 132 arrests, more than 4.8 metric tons of drugs and more than $166 million (€150 million) in cash and crypto.
• United Kingdom: 59 arrests.
• Hungary: 45 arrests.
• Germany: 41 arrests.
• Europe as a whole: more than €60 million in cash and crypto and 950 kilograms of drugs.

Police in Australia, Austria, Czechia, Finland, France, Ireland, the Netherlands, New Zealand and Slovenia also made arrests. Canada does not appear on the list of countries named. FBI Director Kash Patel described it as the largest joint takedown of dark web drug sellers and buyers so far, and federal prosecutions are running in more than 20 US court districts. As always, a charge is only an allegation, and everyone charged is presumed innocent until proven guilty.

The short answer: the markets themselves became evidence. Operation TorNado went after people who had been active on five marketplaces that law enforcement had already seized: Kingdom, Tor2Door, Archetyp, Nemesis and Bohemia. Investigators also chased accounts on DrugHub, on forums, on one-seller shops and in encrypted chat apps.

When police take over a market’s servers, they get its records. The FBI says JCODE studies that data to find who ran the site, who sold on it, who bought and how the money moved, then passes leads to partner agencies abroad. The Justice Department says intelligence gathered after the previous JCODE takedowns is exactly what fed this round of separate but linked investigations.

Three other trails showed up again and again:

1. The mail. Dark web goods have to be shipped. US postal inspectors worked many of the cases. In Pennsylvania, investigators seized about 283 parcels tied to one California-based seller. In a case worked with Australian police, about 35,000 LSD tabs were first caught in the mail, and a later seizure netted roughly 750,000 tabs, which Australian authorities called the largest seizure of its kind in Victoria’s history.
2. The money. Europol says its forensic and blockchain analysis teams followed illegal payments. The head of IRS Criminal Investigation, Jarod Koopman, made the same point in plainer terms: these networks need money to run, and money leaves records.
3. Sharing across borders. National police ran their own cases, with Europol cross-checking details through SIENA, its secure system for swapping information between police forces.

Crypto sits at the center of this story, but the official totals are vaguer than the headline number suggests. Neither the Justice Department nor Europol has said how much of the $234 million was cryptocurrency and how much was cash, and no coin is named in the totals.

The individual cases give clues. One seller featured by the Justice Department worked on DrugHub, which officials describe as a market that accepted only Monero, a cryptocurrency designed to hide who pays whom. In another case, a pair of brothers accused of shipping more than 1,000 parcels of fake oxycodone pills to 49 states, court papers describe bitcoin transfers tied to their seller account and the Nemesis market. Those pills allegedly contained nitazenes, synthetic opioids that can be stronger than fentanyl.

Put together, the record shows police reaching suspects on both a bitcoin trail and a Monero-only market. What it doesn’t show is how they did it in each case, and officials have not said.

Most readers will never visit a dark web market. The lessons still apply to anyone who leans on privacy tools.

• A hidden website is only as private as its operators’ servers. Once police hold the database, past usernames, messages and orders can be read long after the site goes dark.
• Buyers are targets too, not just dealers. TorNado went after both sides of the trade, and its stated focus was opioid networks whose customers reportedly ran into the tens of thousands of Americans.
• Physical goods break digital cover. A package needs an address, and the mail system is where many of these cases started.
• Public blockchains keep receipts. Bitcoin payments sit on a permanent public ledger, which is why agencies across several countries are now comfortable following them.

There is also a safety angle. Counterfeit pills sold as familiar painkillers turned out to contain far stronger synthetic opioids in at least one case, which is why the FBI ranks dark web drug sales among the most urgent public safety threats it faces.

TorNado is the sixth major international JCODE action since the Justice Department set up the team in 2018, and the pattern is familiar. DisrupTor in 2020 brought 179 arrests. Dark HunTor in 2021 caught 150 high-volume sellers. In April 2022, US and German police took down Hydra, then the largest dark web market, with more than 19,000 seller accounts and over 17 million customers. SpecTor in 2023 led to 288 arrests and seized €50.8 million, and RapTor in May 2025 brought 270 arrests across ten countries.

TorNado is billed as the biggest of them all, yet Europol itself admits the markets keep adapting after takedowns. That is the open question: whether the growing trail of seized data now deters buyers and sellers, or just pushes them toward one-seller shops and encrypted chat channels, which this operation also had to chase.

For now, officials say investigations remain open in several countries, so more arrests linked to TorNado are likely to be announced.