Operation TorNado: 354 darknet arrests and $234 million seized, but police do not say how much was crypto

Operation TorNado, a sweep against darknet drug vendors and buyers run by police from 14 countries, has led to 354 arrests, the US Department of Justice and Europol announced on Thursday 12 November. The US release, published by the DEA for the Justice Department’s JCODE team, puts the seizures at more than $234 million “in both cash and virtual currencies”, along with about 5.7 metric tons of drugs, 38 pill presses and 209 firearms. Europol gives the same haul as over EUR 210 million in criminal assets.

Neither release says how much of that money was cryptocurrency. The releases do not split cash from bitcoin, monero or any other coin, and they name no amount per asset. For a sweep built on tracing payments, that is the number crypto readers would most like to see, and it is not public.

The operation ran from May 2025 to October 2026. US officials call it the largest takedown in the history of JCODE, the Joint Criminal Opioid and Darknet Enforcement team created in 2018, and the sixth international action of its kind. FBI Director Kash Patel described it as “the largest interagency takedown of Dark Web drug vendors and buyers to date”. Those superlatives are the officials’ own.

354 darknet market arrests: the United States made 132, the UK 59

The Europol announcement and the DEA release give the same total and the same figure for every country but one. The DEA counts two arrests in Australia, Europol’s table one. Only the DEA’s figures add up to 354 (Europol’s come to 353), so the table uses them. Montenegro made no arrest: its police carried out one “knock and talk”, a visit to a home to question the people living there.

Europol says the targets were vendors and buyers, active on the large markets but also on forums, single-vendor shops and encrypted messaging services. The DEA says they made tens of thousands of sales across the United States, Europe, Australia and New Zealand.

Over EUR 60 million in Europe, $166 million in the United States

Europol splits the seizures by region, which helps read the two headline totals. In Europe, police took 950 kilograms of drugs, 57 firearms and “over EUR 60 million in cash and cryptocurrencies”. The largest drug seizures were 150 kilograms of amphetamines in Germany, 150 kilograms of ketamine in the United Kingdom, 40 kilograms of MDMA in the Netherlands and 50 kilograms of cannabis in France, plus more than one million prescription tablets.

In the United States, the agency counts over 4.8 metric tonnes of drugs, 152 firearms and over EUR 150 million, which it converts to $166 million, again in cash and cryptocurrencies. Add the two regions and you get the 209 firearms, the roughly 5.7 tonnes of drugs and the EUR 210 million of the headlines. The $234 million in the DEA release appears to be the same seizures counted in dollars and rounded differently, not a second pot.

How much of the $234 million is crypto?

The releases do not split it, and their wording leaves no way to work it out. The DEA writes “cash and virtual currencies”. Europol writes “cash and cryptocurrencies”, region by region. Patel’s own statement speaks of “$234 million in cryptocurrency and cash”, in that order, without a split either.

This is not new. Europol’s releases on Dark HunTor (2021), SpecTor (2023) and RapTor (2025) also give a single figure for cash and virtual currencies together. Separate crypto figures appear in those pages only for market takedowns: EUR 3.6 million in cryptocurrencies when Italian police shut the DeepSea and Berlusconi markets in 2021, and EUR 23 million in cryptocurrencies seized by German authorities when Hydra was shut in April 2022.

Nor do the releases say which coins were taken, whether any monero was seized, or how much of the crypto has been converted or is still held in government wallets. The rules for seizing crypto held abroad are changing too: in October, the EU and eight states signed a Council of Europe treaty to seize criminal crypto across borders. Until court filings in the individual cases are read one by one, the crypto share of TorNado stays an open question.

Five markets were already gone: TorNado went after their users

TorNado did not announce the takedown of a new market. It is the follow-up to earlier seizures of five of them: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. When police seize a market’s infrastructure, they get its data. In earlier sweeps, Europol turned that data into what it calls intelligence packages, which national police forces then used to open their own cases.

The model is explicit in Europol’s own material. Its RapTor release of May 2025 described a market takedown as “the beginning of follow-up investigations” rather than the end of the story. For TorNado, Europol says its forensic and blockchain analysis teams “traced illicit transactions”, while national authorities ran their own investigations and cross-checked data through SIENA, the agency’s secure information exchange network.

On the US side, vendor accounts were “identified and attributed to real individuals” on markets including DrugHub and Archetyp, the DEA says. A darknet vendor name is of no use to a prosecutor until it is tied to a person with an address.

How the money was followed in the BarbaraWhite case

The clearest public example of the method comes from one of the cases the DEA now lists under TorNado. On 28 August, the Justice Department announced the arrest in Florida of two brothers, Stanislav Chernyshov, 30, a Russian national, and Vladislav Chernyshov, 35, a naturalized US citizen. Prosecutors allege they ran “BarbaraWhite”, a vendor that sold counterfeit oxycodone M30 pills laced with nitazenes, synthetic opioids that can be as strong as fentanyl or stronger. They are charged in the Eastern District of Virginia and each faces up to 20 years in prison if convicted.

On 8 September, the blockchain analysis firm Chainalysis published how the crypto was traced, based on the FBI affidavit. Investigators first found, in data from a separate investigation, the bitcoin addresses BarbaraWhite allegedly used to withdraw its market earnings. The affidavit includes a graph made with Chainalysis Reactor, the firm’s tracing software, showing funds moving between those wallets and addresses linked to likely buyers and other vendors.

The link to a person came from the edges of the graph. According to Chainalysis, the vendor’s wallets had “common interactions” with wallets traceable to Stanislav’s mobile payment account. Investigators combined that with marketplace data, postal records, surveillance and undercover purchases.

The affidavit figures, as Chainalysis reports them, are small next to TorNado’s total. The wallet cluster received about $220,000 from darknet markets and sent out about $230,000, including payments to a postage service, another drug vendor and about $7,210 to a China-based research chemical supplier that investigators allege provided the nitazenes. Records from three markets, Nemesis, Bohemia and Abacus, show more than 95,000 counterfeit pills sold, and the vendor is linked to at least 12 overdoses, including three deaths. These are allegations; none of it has been proven in court.

Bitcoin leaves a public trail, Monero-only markets do not

The case shows why bitcoin is a poor tool for staying hidden. Every bitcoin transaction is written on a public ledger that anyone can read forever. Addresses carry no names, but the trail between them is open, and it only takes one address tied to an identified account, at an exchange or a payment app that checks identity, to put a name on a whole cluster. Our glossary entry on KYC (Know Your Customer) explains why those identity checks matter so much to investigators.

Some markets answered by refusing bitcoin. The DEA describes DrugHub as a “Monero-only” market. Monero (XMR) hides senders, receivers and amounts by default, so the wallet-to-wallet analysis used against BarbaraWhite does not work the same way. One TorNado case sits there: Alexander Green, 32, arrested in June and charged in the Southern District of Ohio, is accused of selling fentanyl and other drugs on DrugHub under the name STARLABS, a business prosecutors link to two overdose deaths.

How Green was identified is not in the release, and it would be a guess to say the Monero trail was cracked. What the record does show is that privacy coins protect the chain, not the rest. When a Monero swap service leaked its records last month, the chain stayed private but the database did not. Shipping labels, seized servers and the moment coins are swapped into money people can spend remain weak points.

Four sweeps since 2021, from 150 to 354 arrests

Europol presents TorNado as the latest in a series that began with DisrupTor in 2020 (179 arrests). The figures below come from Europol’s own releases on Dark HunTor, SpecTor, RapTor and TorNado. Each seizure line mixes cash and virtual currencies.

Arrests more than doubled between 2021 and 2026, and the money seized grew about eightfold in euro terms. The comparison has limits. Each sweep followed different market takedowns, ran over a different period and involved a different set of countries, so the trend says as much about the size of the seized databases as about the size of the trade.

SpecTor also left a detail on how market operators clean their crypto. Europol said the alleged operator of Monopoly Market, extradited from Austria to the United States in June 2023, used at least two crypto exchange services to move proceeds between blockchains before selling the coins to traders in Serbia for cash.

France made 23 arrests, Italy was not part of TorNado

In France, the Gendarmerie nationale took part and made 23 arrests, with 50 kilograms of cannabis among the European seizures. That is fewer than the 29 French arrests of RapTor in 2025 but far more than the five of SpecTor in 2023. Europol gives no French figure for crypto.

Italy is not among the 14 countries of TorNado, and no Italian agency appears in either list of participants. It was part of Dark HunTor in 2021, with four arrests and the DeepSea and Berlusconi takedowns. In Europe, the largest contingents this time came from the United Kingdom (59), Hungary (45) and Germany (41).

What readers should take from Operation TorNado

For anyone who thinks a darknet purchase paid in bitcoin is anonymous, the record of these sweeps says otherwise. Buyers were targeted along with vendors, and Europol warned after SpecTor that access to vendors’ buyer lists put thousands of customers at risk of prosecution. Europol’s own warning from 2021 still stands: using the dark web for criminal activity can lead to prison in a number of countries. The pills carry their own risk: BarbaraWhite’s alleged “FENT FREE” pills often contained nitazenes, according to Chainalysis.

For ordinary crypto holders, TorNado is mostly a reminder of how traceable public blockchains are. The same analysis that maps a drug vendor’s wallets can map anyone’s, once one address is tied to a name. IRS Criminal Investigation chief Jarod Koopman put the investigators’ logic plainly: criminal networks “cannot operate without money”.

Investigations continue in more than 20 US districts

The DEA says TorNado led to dozens of federal prosecutions, conducted in more than 20 districts from the Central District of California to the Western District of Wisconsin, and that several investigations are still trying to identify the people behind darknet accounts. The named defendants are charged, not convicted, and are presumed innocent.

Europol expects the trade to move rather than stop. Its 2026 Internet Organised Crime Threat Assessment, cited in the TorNado release, points to markets splitting into specialised platforms, forums mixed with encrypted messaging, and the quick replacement of any market that is shut. The DEA links the court documents of the US cases from its release; any wallet-level detail on TorNado’s crypto would have to come from filings like those.