Operation TorNado hits darknet drug markets with 354 arrests, $234 million in seizures

Law enforcement agencies in 14 countries have arrested 354 people and seized about $234 million in cash and cryptocurrency in Operation TorNado, a darknet crackdown that targeted opioid suppliers and the buyers using dark web marketplaces.

The Joint Criminal Opioid and Darknet Enforcement team (JCODE), which called it its largest takedown yet, announced the results on November 12, 2026, after investigations running from May 2025 through October 2026. Authorities also recovered about 5.7 metric tons of drugs and 209 firearms.

Operation TorNado produces major seizures in the United States

American authorities accounted for the largest reported share of the operation’s drug and financial seizures.

Investigators in the United States made 132 arrests, recovered 4.8 metric tons of drugs and confiscated approximately $166 million in assets. Those domestic results formed part of the international totals rather than a separate enforcement action.

The scale of the U.S. seizures reflects the operation’s stated focus on trafficking networks serving American customers. Authorities were targeting the organisations and individuals supplying opioids through darknet marketplaces, as well as people purchasing drugs through those platforms.

Operation TorNado also recovered firearms, adding a physical security dimension to an investigation involving online sales and digital payments. The supplied report gives a worldwide total of 209 weapons but does not provide a country-by-country breakdown.

The announcement presents aggregate results from numerous investigations. It does not identify the criminal charges associated with every arrest or establish that all detained individuals have been convicted.

European arrests extend the crackdown across borders

European law enforcement agencies seized nearly one metric ton of drugs and more than €60 million in cash and cryptocurrency.

The United Kingdom recorded 59 arrests, followed by Hungary with 45 and Germany with 41. Those figures account for some of the arrests outside the United States, but the report does not provide a complete breakdown for all 14 participating countries.

The geographical spread of Operation TorNado shows the importance of coordination when sellers, customers and financial assets can be located in different jurisdictions.

Its reach extended beyond vendors. Investigators also targeted buyers active on dark web marketplaces that law enforcement had previously compromised.

That approach widened Operation TorNado from a supplier-focused crackdown into an investigation of activity on both sides of marketplace transactions. The report does not name the affected platforms or explain how evidence from them was used in individual cases.

The distinction between vendors and buyers also matters when interpreting the arrest total. The 354 arrests should not be read as representing 354 separate trafficking organisations or marketplace operators.

Operation TorNado follows earlier JCODE campaigns

The crackdown builds on Operation SpecTor in 2023 and Operation RapTor in 2025.

Those earlier JCODE efforts used a similar combination of international cooperation, marketplace infiltration and coordinated arrests. The latest operation continues that approach, using previously compromised marketplaces to pursue people involved in darknet drug transactions.

The extended investigation period distinguishes the announcement from a single-day raid. Operation TorNado covered activity from May 2025 through October 2026, with the November announcement bringing together the results.

That timeline helps explain the breadth of the reported seizures and arrests. The figures represent cumulative enforcement outcomes across countries and investigations, rather than assets recovered from one marketplace or one criminal group.

The report also identifies a continuing challenge: darknet markets can adapt after major enforcement actions. The arrests and seizures demonstrate disruption, but they do not establish that online drug trafficking has ended.

Cash and cryptocurrency seizures highlight financial investigations

The financial results of Operation TorNado underline the role of payment tracing and asset seizures in darknet investigations.

Cryptocurrency is part of the payment infrastructure used by these marketplaces. The report links the outcome to authorities’ growing ability to track and disrupt financial flows associated with drug trafficking.

However, the $234 million headline figure combines cash and cryptocurrency. The supplied account does not disclose how much was seized specifically in digital assets, which cryptocurrencies were involved or whether their values were calculated at a common date.

It also does not detail the tracing methods used in particular cases. The financial total therefore should not be presented as proof that every seizure resulted from public-blockchain analysis.

Operation TorNado ultimately brought together arrests, drug interdictions, firearm recoveries and financial seizures across 14 countries. Its reported results demonstrate the reach of coordinated enforcement while leaving the longer-term impact on adapting darknet markets unresolved.