York Regional Police launched Project Ghostwire in January 2026 after identifying a dark web drug trafficking operation called “Icy White North.” Active since approximately 2022, the platform accumulated 9,000+ positive reviews and generated over $100,000 a month in revenue. Five GTA-based suspects were arrested. Seized items include $3 million worth of drugs, including fentanyl, cocaine, MDMA, heroin, meth, and LSD, along with luxury goods and a significant amount of cryptocurrency. The operation used Canada Post to deliver orders to customers nationwide.
On September 22, 2026, York Regional Police announced the network was gone. Five people from the Greater Toronto Area are now facing more than 80 charges following a nine-month investigation called Project Ghostwire.
York Regional Police launched Project Ghostwire in January 2026 after identifying a dark web drug trafficking operation called “Icy White North.” Active since approximately 2022, the platform accumulated 9,000+ positive reviews and generated over $100,000 a month in revenue. Five GTA-based suspects were arrested. Seized items include $3 million worth of drugs, including fentanyl, cocaine, MDMA, heroin, meth, and LSD, along with luxury goods and a significant amount of cryptocurrency. The operation used Canada Post to deliver orders to customers nationwide.
On September 22, 2026, York Regional Police announced the network had been dismantled. Five people from the Greater Toronto Area are now facing more than 80 charges following a nine-month investigation called Project Ghostwire.
What “Icy White North” Actually Was
This wasn’t a street corner operation. It was structured more like an online retail business, just an illegal one selling controlled substances.
According to Det.-Sgt. Stephen Beale of York Regional Police, the platform operated primarily through the dark web and encrypted communications, targeting Canadian customers exclusively. “Unlike traditional street-level drug trafficking, the icy white north operation utilized a commercial-style model. Drugs were advertised through digital marketplaces, orders were processed through encrypted communications, and shipments were delivered to customers through Canada’s legitimate parcel and postal infrastructure,” Beale said at a press conference Tuesday morning.
The use of Canada Post is the detail most people find surprising, but it’s become a recurring feature of Canadian dark web drug operations. Packages sent through regular postal networks blend into millions of daily deliveries. Unless there’s a specific tip or pattern to flag, distinguishing an illegal drug shipment from ordinary online shopping is genuinely difficult at scale.
Quantities on offer ranged from small personal amounts to kilogram-level transactions. The platform catered to every tier of buyer.
9,000 Reviews and Four Years of Operation
The most striking detail to emerge from Tuesday’s press conference isn’t the drug seizure total. It’s the review count.
Beale confirmed that “online sources indicated that Icy White North had accumulated more than 9,000 positive reviews” by the time the investigation began. That number reflects a sustained operation spanning roughly four years of consistent business, enough to build the kind of reputation that attracts repeat customers and new buyers who need reassurance before making a first purchase.
Dark web drug markets function with the same basic trust mechanics as legitimate platforms. Buyers leave feedback. Sellers build scores. New users check ratings before transacting. As we’ve covered in our breakdown of how dark web criminal markets self-regulate through reputation systems, a strong review score is operational currency. It’s what separates successful long-running operations from short-lived fly-by-night listings that get abandoned after a few scams.
9,000 positive reviews over four years represent thousands of completed drug transactions. That’s not a side project. That’s a business.
The Fentanyl Mislabelling Problem
One incident highlighted by investigators carries a specific public health weight.
In promotional posts advertising available inventory, a drug was listed as “purple heroin.” When investigators analyzed the substance, it turned out to be fentanyl, a synthetic opioid vastly more potent by weight than heroin. Someone who bought that listing expecting heroin would have received something with a substantially different and far more dangerous risk profile.
This kind of mislabelling isn’t unique to this operation. It’s common across dark web drug markets and represents a serious harm reduction challenge. Buyers who believe they’re purchasing one substance may unknowingly consume another with significantly different dosing characteristics. The result is that even in an illegal market where buyers theoretically consent to drug use, they often can’t consent to what they’re actually taking because the listing isn’t accurate.
How Cryptocurrency and Canada Post Combined
The operational model Beale described- dark web advertising, encrypted orders, Canada Post delivery- is specifically designed to create distance between the sellers and the product at every stage.
The sellers never meet buyers. Orders come through encrypted platforms. Packages ship through legitimate postal infrastructure that processes millions of items daily. Cryptocurrency payments remove the banking paper trail that financial investigators would normally follow.
Investigators nonetheless built the case over nine months. Cryptocurrency, despite being designed for pseudonymity, leaves a blockchain trail that can be traced with time and resources. The same forensic principle helped crack the AudiA6 cryptocurrency laundering network earlier this year. A “significant amount of cryptocurrency” was seized alongside the drugs and luxury goods, though York Regional Police have not released a specific figure.
Part of a Broader Ontario Pattern
Project Ghostwire didn’t emerge in isolation. Ontario has seen multiple dark web drug trafficking takedowns in quick succession.
In September 2025, the RCMP dismantled “RoadRunna,” described at the time as one of the largest known Canadian dark web drug operations. That GTA-based network shipped approximately 400 packages per week nationally. Seven people were arrested.
In June 2025, Ontario Provincial Police busted another dark web network also using Canada Post for delivery.
The Icy White North operation adds to this timeline, and the pattern is consistent: GTA-based operators, dark web marketplaces, encrypted communications, and Canada Post as the delivery backbone. As law enforcement disrupts one operation, another has historically emerged to fill the market gap. Operation Alice, the Europol takedown of 373,000 dark web sites earlier in 2026, showed the same dynamic globally: closing one marketplace creates pressure but rarely eliminates demand.
What Happens Next
The five accused are facing more than 80 charges collectively. York Regional Police have not released the names of those arrested or detailed which specific charges each person faces.
The cryptocurrency seized will be subject to standard proceeds-of-crime proceedings. Details on the luxury goods seized have not been disclosed.
The investigation is ongoing for anyone who ordered from or interacted with the platform. Data gathered from seized devices and accounts may extend the inquiry beyond the five initial arrests.
York Regional Police ask anyone with information related to dark web drug trafficking to contact them directly at yrp.ca or anonymously through Crime Stoppers.
Frequently Asked Questions
What was Icy White North?
A dark web drug trafficking platform active since approximately 2022, catering exclusively to Canadian customers and generating over $100,000 a month in revenue.
How many people were arrested?
Five people, all with links to the Greater Toronto Area, now face more than 80 charges.
What drugs were seized?
Fentanyl, cocaine, heroin, methamphetamine, MDMA, LSD, and illicit prescription pills, totalling $3 million worth of controlled substances.
How did the platform deliver drugs?
Through Canada Post, using regular parcel delivery to reach customers nationwide while maintaining distance between sellers and buyers.
What else was seized?
Luxury goods and a significant amount of cryptocurrency. Exact figures have not been disclosed.
