354 Arrested. The Dark Web’s Biggest Bust.

The knock on the door was the end of an eighteen-month operation. Authorities in 14 countries have arrested 354 suspects in Operation TorNado, a joint international crackdown on vendors and buyers who traded on five dark web marketplaces — Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom. It is, the FBI says, the largest interagency takedown of dark web drug vendors and buyers to date.

The scale of the seizures matches the arrests. Worldwide, law enforcement took more than $234 million in cash and cryptocurrency, roughly 5.7 metric tonnes of illicit drugs — fentanyl and other opioids, methamphetamine, heroin, cocaine, ecstasy and MDMA — 38 pill presses, and 209 firearms. The operation ran from May 2025 to October 2026, coordinated by Europol and the Justice Department’s Joint Criminal Opioid and Darknet Enforcement team, known as JCODE.

Where the arrests landed

The United States accounts for the largest share: 132 arrests, more than 4.8 tonnes of drugs, 152 firearms, and over $166 million seized. In Europe, authorities seized over $66 million in cash and cryptocurrency, 950 kilograms of drugs — amphetamines, cocaine, ketamine, psilocybin mushrooms, MDMA and cannabis — and 57 firearms. The arrest counts by country underline how distributed the trade had become: 59 in the United Kingdom, 45 in Hungary, 41 in Germany, 23 in France, 13 in New Zealand, 12 in the Netherlands, 11 in Slovenia, and smaller numbers in Australia, Austria, Czechia, Finland and Ireland.

The targets were not only the five big markets. Investigators also went after vendors and buyers active on forums, single-vendor shops and encrypted messaging services — the places the trade retreats to whenever a marketplace falls. The Justice Department says the arrested traffickers engaged in tens of thousands of sales of illicit goods and services, and that the operation has already produced dozens of federal prosecutions in the United States. A number of investigations are still running to identify the people behind dark web accounts that have not yet been attributed — Europol’s phrasing leaves little doubt that more arrests are expected to follow from the same evidence.

Seized markets became the map

The method matters more than the headline numbers. Several of the targeted marketplaces had already been seized by law enforcement, and the data inside them became the map: vendor accounts were identified and attributed to real individuals who had made tens of thousands of sales of illicit goods and services. National authorities ran their own investigations with Europol’s support, including cross-checks through SIENA, the agency’s secure information exchange, and forensic analysis to tie accounts to people.

TorNado is the sixth internationally coordinated action since JCODE was created in 2018, and the most extensive. It builds directly on last year’s Operation RapTor — 270 vendor and buyer arrests across 10 nations in May 2025, itself a record at the time — and on a line of operations stretching back through Dark Huntor in 2021 (150 arrests) and DisrupTor in 2020 (179). Each round has been larger than the last — and each time, Europol notes, the markets adapt: new platforms, new channels, new operational habits. “Operation TorNado is the largest interagency takedown of Dark Web drug vendors and buyers to date,” FBI Director Kash Patel said, announcing 132 arrests in the United States alone.

The pattern behind the headline

For defenders and investigators, the durable lesson is the attribution pipeline. A dark web vendor account feels anonymous from the inside; in practice it accumulates years of operational mistakes — reused details, shipping patterns, cryptocurrency trails — and when a marketplace is seized, all of it becomes evidence at once. The same pipeline powered Operation Endgame’s seizure of 257 domains and 235 servers earlier this month, and the identity work that surfaced in the unmasking of Qilin’s alleged administrator. The markets will rebuild; they always do. But 354 people who believed the dark web made them invisible are now case numbers — and the investigations into the accounts still unattributed are, by the agencies’ own statement, still open.