Operation TorNado Leads to 354 Arrests and $234 Million Seized in Darknet Drug Sweep
US and European authorities announced results of Operation TorNado on November 12, reporting 354 arrests across 14 countries and about $234 million in cash and crypto seized. Officials did not split the total between cash and cryptocurrency, and the operation builds on earlier JCODE takedowns.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Scale of the Takedown
US authorities and Europol announced 354 arrests and roughly $234 million in seized cash and cryptocurrency from Operation TorNado, a darknet drug operation coordinated across 14 countries. Officials said the work ran from May 2025 to October 2026 and seized about 5.7 metric tons of drugs and 209 firearms.
The Justice Department's Joint Criminal Opioid and Darknet Enforcement team, known as JCODE, led the US side. The FBI described the operation as the largest takedown of dark web drug vendors and buyers to date, and as the sixth internationally coordinated JCODE action since the group was created in 2018.
Where the Money and Drugs Came From
The two sources differ slightly on how the operation's totals are framed. One report describes the $234 million as a combined figure of cash and crypto. The Justice Department and Europol said the combined total exceeded $234 million, but neither agency broke it down between cash and cryptocurrency, and neither named bitcoin or any other coin in its official totals.
Regional figures also mix the two. Europol put the European share at more than €60 million in cash and cryptocurrency, plus 950 kilograms of drugs and 57 firearms. The US share was $166 million in cash and cryptocurrency, more than 4.8 metric tons of drugs and 152 firearms. Europol said its forensic and blockchain analysis teams traced illicit transactions as part of the work.
The drugs included fentanyl and other opioids, methamphetamine, heroin, cocaine, ecstasy and MDMA, along with 38 pill presses.
How Vendors Were Paid
The clearest public evidence of crypto payments comes from individual cases. Alexander Green, 32, of Jacksonville, North Carolina, was arrested in June and charged in the Southern District of Ohio with conspiracy to distribute controlled substances including fentanyl. The Justice Department said he allegedly ran the vendor STARLABS on DrugHub, which it described as a Monero-only market. A criminal complaint says undercover purchases were made "in exchange for cryptocurrency."
In Florida, brothers Stanislav Chernyshov, 30, and Vladislav Chernyshov, 35, face charges in the Eastern District of Virginia. Prosecutors allege they ran the vendor BarbaraWhite, selling counterfeit oxycodone pills laced with nitazenes. A search-warrant affidavit describes bitcoin transfers tied to that account and to the Nemesis market. Each defendant faces up to 20 years if convicted.
Targets and Ongoing Investigations
The operation targeted vendors and buyers active on five dark web markets that law enforcement had already seized: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. Officials also identified accounts on DrugHub, on forums, on single-vendor shops and on encrypted messaging services.
Arrests were concentrated in the US with 132, followed by 59 in the United Kingdom, 45 in Hungary and 41 in Germany, with further arrests in France, New Zealand, the Netherlands, Slovenia, Austria, Ireland, Czechia, Australia and Finland. The Justice Department said investigations are continuing to identify people behind remaining accounts, and federal prosecutions are underway in more than 20 districts.
All charges are allegations. Defendants are presumed innocent until proven guilty.
Context From Prior Operations
TorNado follows Operation SpecTor in 2023 and Operation RapTor in 2025, using a similar model of international coordination, marketplace infiltration and mass arrests. The outcome has been presented by authorities as evidence that blockchain tracing is increasingly effective against drug-trafficking finances. Industry researchers have also noted that dark web marketplaces have historically adapted after each crackdown.
Why It Matters
For Traders
Enforcement activity against privacy coins and mixers tied to darknet markets can raise short-term headline sensitivity, though the seizure is not a market-moving supply event.
For Investors
Repeated JCODE takedowns signal sustained, cross-border blockchain tracing capability, which strengthens the case that public-ledger activity remains traceable to law enforcement.
For Builders
Developers of privacy tooling should expect continued scrutiny of marketplace-linked flows and should weigh compliance and tracing risk when designing transaction privacy features.
This article is for information only and is not financial advice. Read the full disclaimer.
