What Operation TorNado Actually Was
Operation TorNado ran from May 2025 to October 2026 , 18 consecutive months of raids, surveillance, undercover purchases, cryptocurrency tracing, and targeted arrests across dark web drug marketplaces.
Europol coordinated the operation alongside Eurojust, with participating countries including the United States, United Kingdom, Australia, France, Germany, and nine others. The targets were vendors and buyers from major dark web marketplaces , the same type of platforms that have been a persistent enforcement priority for law enforcement agencies since Silk Road was taken down over a decade ago.
The scale dwarfs previous comparable operations. Operation DisrupTor in 2020, then the largest US dark web drug sweep, resulted in 179 arrests and $6.5 million in seizures. Operation TorNado nearly doubled the arrest count and seized roughly 23 times more in assets. The €150 million figure includes both cash and cryptocurrency confiscated from accounts tied to dark web drug proceeds.
The operation highlighted something Europol stated explicitly: “dark web marketplaces continue to adapt despite takedowns.” The fact that the same enforcement framework that shut down platforms over the past decade still faces rebuilt markets is a central challenge , and central context for why operations of this scale keep being necessary.
What Was Seized and Where
The seizure breakdown tells a specific story about where dark web fentanyl trafficking concentrates.
In the United States, law enforcement seized 4.8 tonnes of drugs , a figure that represents the bulk of the total global seizures across the entire operation. The types included fentanyl, opioids, and synthetic drugs being sold through dark web vendors and shipped via mail.
Across Europe, authorities seized nearly one tonne of illicit drugs , including amphetamines, ketamine, MDMA, cocaine, and cannabis. The European drug mix reflects different demand patterns from US markets, though fentanyl continues to expand its reach internationally.
152 firearms were seized globally. The presence of weapons alongside drug trafficking is consistent with what law enforcement agencies describe as the increasing overlap between dark web drug markets and arms markets , the same vendors or networks sometimes list multiple illegal product categories on the same platforms.
The €150 million in cash and cryptocurrency forfeiture is the figure that matters most for the long-term damage to these networks. Money is what sustains them. As we’ve covered in looking at how cryptocurrency laundering operations like AudiA6 kept ransomware and dark web drug economies running, seizing proceeds removes the financial incentive that makes dark web drug sales attractive relative to street-level dealing.
Why Fentanyl Is the Focus
The specific mention of fentanyl and opioids in the official announcement framing isn’t random.
Fentanyl is the leading cause of drug overdose deaths in the United States. The DEA’s ongoing Fentanyl Free America initiative places dark web sales alongside street trafficking as a priority enforcement target because of one specific characteristic: dark web fentanyl reaches buyers directly by mail, bypassing the in-person risk and geographic limitations of traditional drug markets. Someone in a rural area with no access to a local drug supply can order fentanyl to their mailbox in days.
The involvement of the US Postal Inspection Service alongside the FBI and DEA in this operation reflects how critical the postal network has become to dark web drug distribution. USPIS agents work from the package-screening end of the supply chain , scanning for packages consistent with dark web drug shipments ,while DEA and FBI work from the financial and digital investigation side. Both are needed because the concealment methods on each end are sophisticated.
As we covered in our earlier reporting on Project Ghostwire and the Icy White North dark web drug network, the pattern is consistent across countries: a dark web storefront, cryptocurrency payments, and postal delivery as the last mile. Operation TorNado targeted that full chain, not just the visible marketplace layer.
The IRS and FDA Angle
Two agencies that don’t appear in typical drug enforcement announcements were specifically included in this press conference: the IRS and the FDA.
The IRS Criminal Investigation division’s presence signals that financial investigation , following cryptocurrency payments, tracing illicit proceeds, building money laundering cases alongside drug trafficking charges , is a core part of how these prosecutions work. The Empire Market case we covered recently, where co-creator Raheim Hamilton received 40 years in federal prison, included massive Bitcoin and Ethereum forfeitures as a central part of the prosecution’s outcome. Financial charges can extend sentences and strip proceeds even from defendants who might negotiate down on drug counts alone.
The FDA’s involvement connects to the counterfeit pharmaceutical side of dark web drug markets. Fentanyl pressed into fake prescription pills , Xanax, oxycodone, Adderall , is one of the leading causes of accidental overdose deaths, particularly among younger buyers who believe they’re purchasing a pharmaceutical and receive fentanyl instead. FDA special agents investigate the counterfeit pill supply chain, which regularly intersects with dark web vendor networks.
132 US Arrests: Who Was Targeted
The United States accounted for 132 of the 354 total arrests , the single largest national contribution to Operation TorNado’s arrest numbers.
Europol’s framing described the targets as vendors and buyers from major dark marketplaces. That distinction matters. Previous enforcement operations have focused primarily on platform operators , the people who build and run the marketplaces. Operation TorNado targeted the people actively using those platforms to sell and purchase drugs. This vendor-and-buyer level targeting is specifically designed to reduce confidence in the platforms by showing that anonymity within them doesn’t ultimately protect users.
The United Kingdom contributed 59 arrests, the second highest total. Australia, France, Germany, and the nine other participating countries accounted for the remaining 163. The geographic spread reflects both where dark web drug markets concentrate users and where law enforcement capacity exists for undercover marketplace participation.
The Pattern That Keeps Repeating
Europol’s own statement acknowledged the cycle: dark web marketplaces “continue to adapt despite takedowns.” Operation TorNado is not the final chapter of dark web drug enforcement , it’s a chapter in a long series.
After AlphaBay was shut down in 2017, Empire Market launched within months. After Hansa was taken, new platforms emerged. Operation TorNado’s 354 arrests will disrupt specific vendor networks and reduce specific supply chains. It won’t eliminate dark web drug markets. The enforcement community knows this, which is why the focus has shifted toward arresting vendors and buyers rather than just taking down platforms , removing the human supply chain alongside the digital infrastructure.
For anyone wondering how their data intersects with dark web drug markets , particularly regarding mail interception risks and postal surveillance , our guide on what to do when your personal information is on the dark web covers the monitoring and protection steps that remain relevant regardless of these enforcement actions.
Frequently Asked Questions
What is Operation TorNado?
An 18-month international law enforcement operation coordinated by Europol and Eurojust, running from May 2025 to October 2026, targeting vendors and buyers on dark web drug marketplaces across 14 countries.
How many arrests were made in Operation TorNado?
354 arrests worldwide. 132 occurred in the United States, 59 in the United Kingdom, with the remaining 163 across 12 other participating countries.
What was seized in the operation?
4.8 tonnes of drugs in the US, nearly 1 tonne of drugs across Europe, 152 firearms, and €150 million in cash and cryptocurrency.
Why was AG Blanche’s press conference initially postponed?
The Justice Department briefly postponed the 10 a.m. EST announcement on November 12, citing no specific reason. The announcement was subsequently made and broadcast on C-SPAN.
What agencies were involved in the US side of the operation?
The FBI, DEA, Homeland Security Investigations (HSI), the US Postal Inspection Service (USPIS), IRS Criminal Investigation, and the FDA all participated in the coordinated crackdown.
How does Operation TorNado compare to previous operations?
Operation DisrupTor in 2020 resulted in 179 arrests and $6.5 million seized. TorNado nearly doubled the arrests (354) and seized roughly 23 times more in assets (€150M), making it one of the largest dark web drug operations on record.