The U.S. Department of Justice and Europol announced on November 12 that Operation TorNado, an international crackdown on dark web drug trafficking, resulted in more than $234 million in combined seizures of cash and cryptocurrency. The operation, which ran from May 2025 through October 2026, led to 354 arrests worldwide, including 132 in the United States.
Authorities also confiscated 209 firearms, 38 pill presses, and 5.7 metric tons of illicit drugs, including fentanyl. American authorities seized $166 million in cash and cryptocurrency, while European seizures exceeded 60 million euros alongside 950 kilograms of drugs and 57 firearms.
Coordinated International Effort
Operation TorNado was the sixth and most extensive internationally coordinated action by the FBI-led Joint Criminal Opioid and Darknet Enforcement team, known as JCODE, since its creation in 2018. The campaign spanned the United States, Europe, Australia, and New Zealand, with Europol supporting agencies in 14 countries through forensic and blockchain analysis, intelligence sharing, and coordination.
Blockchain Intelligence Links Vendor to Deaths
One prosecution highlighted the use of cryptocurrency tracing technology. Blockchain intelligence firm Chainalysis linked the darknet account BarbaraWhite to Stanislav Chernyshov, who was arrested in Florida along with his brother Vladislav. The brothers were accused of distributing counterfeit pills containing nitazenes, highly potent synthetic opioids. According to Chainalysis, the vendor account was linked to at least 12 overdoses, including three deaths.
Investigators used digital currency transaction mapping, mobile payment records, postal records, surveillance, and undercover purchases to build the case.
Targeting Dismantled and Active Marketplaces
Operation TorNado pursued users of seized marketplaces including Archetyp, Bohemia, Nemesis, Kingdom, and Tor2Door. The Archetyp marketplace takedown in June 2025 across six countries resulted in eight arrests and 7.8 million euros in seized assets. Nemesis faced financial enforcement following its March 2024 shutdown, with Treasury sanctions targeting its alleged administrator and identifying 49 bitcoin and monero addresses in March 2025.
Federal prosecutions were underway in more than 20 U.S. districts. Europol noted that disrupted marketplaces were rapidly replaced as criminals migrated to new platforms, with investigations continuing to identify people behind remaining dark web accounts.
