Operation TorNado: 354 arrested chasing five dead darknet markets

A Europol-coordinated operation named TorNado arrested 354 dark web vendors and buyers across 14 countries, authorities said. Per Europol's announcement, the action seized more than €210 million in criminal assets and about 5 tonnes of drugs. Unusually, the targets were not a live marketplace but the users of five markets that were already offline — Archetyp, Bohemia, Nemesis, Kingdom, and Tor2Door — plus traders on forums, single-vendor shops, and encrypted messaging.

What happened

TorNado ran from May 2025 to October 2026, with Europol and the U.S. Department of Justice coordinating national agencies through hundreds of house searches. It is a continuation strategy: once a market is seized, its vendor and buyer records become leads, and the follow-up operation works those leads long after the site is dark. BleepingComputer and Help Net Security report the same core figures.

By country, reporting puts the arrests at 132 in the United States, 59 in the UK, 45 in Hungary, 41 in Germany, 23 in France, 13 in New Zealand, 12 in the Netherlands, 11 in Slovenia, six in Austria, five in Ireland, four in Czechia, two in Australia, and one in Finland.

A note on the seizure figures

The totals vary by source and scope, so read them with care. Europol gives a global figure of over €210 million in criminal assets and about 5 tonnes of drugs. BleepingComputer breaks out a Europe-only subset — over €60 million ($66 million) in cash and cryptocurrency, roughly 950 kg of drugs, and 57 firearms — while the DOJ reports the U.S. portion at over 4.8 tonnes of drugs, 152 firearms, and more than €150 million ($166 million). Firearm counts in particular differ between outlets; where numbers conflict, we cite the range rather than pick one.

What this means for defenders

There is no patch here and nothing to install — this is law enforcement, not a vulnerability. The operational signal is for threat intel and fraud teams: seized-market data keeps producing arrests more than a year after takedown, which is why operators who touched these markets (including via leaked logs or reused handles) remain exposed to attribution long after the storefront disappears.

Context

This is the latest in a sustained run of darknet enforcement — the same pattern as the Operation Endgame malware takedowns we covered this week, where infrastructure seizures and user-level prosecutions now arrive as a one-two punch rather than a single raid. Markets get replaced quickly; the records they leave behind do not expire, and the agencies have learned to mine them for years.