Europol and the US Justice Department announced Operation TorNado on Thursday, and the headline numbers are 354 arrests across 14 countries, five tonnes of drugs and more than €210 million in cash and crypto. The part worth reading past is how the arrests happened. This was not a new darknet market being infiltrated. It was police going back through five darknet markets that had already been seized and working out who had used them.
Europol names the five: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. The operation ran from May 2025 to October 2026, and the release describes a "follow-up action focused on the identification of suspects after the takedown" of those markets. Investigators also worked through forums, single-vendor shops and encrypted messaging services, while national teams ran their own cases with Europol cross-checking through SIENA and providing forensic and blockchain analysis.
For anyone who follows darknet markets, the useful detail is the gap between seizure and arrest. The data outlives the site. A darknet market can go offline with a banner and a PGP-signed goodbye, and the order history can still be sitting in a police system two years later, waiting for someone to match it to a name.
What it means if you used those darknet markets
Those five names are a roll call of darknet markets from the last few years. Archetyp went down in June 2025 with its administrator arrested; the others were taken off the board around the same stretch. In each case the public story ended with a seizure banner and a wave of posts telling people to stop sending money. TorNado suggests that for the customers, the story did not end there.
That is the uncomfortable part. Darknet market takedowns get framed as a vendor problem. The admin is arrested, the escrow is gone, the listings vanish, and buyers reasonably assume their exposure died with the site. TorNado is a demonstration that it does not. Order records, shipping details, account metadata and support messages survive the seizure, and a year and a half later they can turn into a knock at the door. The United Kingdom contributed 59 arrests and the United States 132, which is a lot of doors.
What Europol does not say is how the 354 split between vendors and buyers, which market each arrest came from, or which dataset produced which lead. The operation targeted "vendors and buyers", so the buyer share could be a handful or most of it. The country numbers are precise; the attribution behind them is not.
Where the arrests landed
The country table is unusually specific. The United States made 132 arrests, the UK 59, Hungary 45, Germany 41, France 23, New Zealand 13, the Netherlands 12, Slovenia 11, Austria 6 and Ireland 5. Czechia made 4, Australia 1, and Finland 1 alongside 159 interviews. Montenegro's entry is a series of "knock and talks", where officers visit a residence and ask to speak with whoever is home. That is not the same thing as an arrest, and the totals are best read as police activity rather than convictions.
What was seized
In Europe, authorities took 950 kilograms of drugs. The largest single hauls were 150 kilograms of amphetamines in Germany and another 150 in the UK, 40 kilograms of MDMA in the Netherlands, and 50 kilograms of cannabis in France, alongside cocaine, psilocybin mushrooms, THC vapes and more than a million prescription tablets. They also seized 57 firearms and ammunition and over €60 million in cash and crypto. In the United States the figures were 4.8 tonnes of drugs, 152 firearms and over €150 million, which the DOJ puts at $166 million. Europol rounds the drug total to five tonnes; the two regional figures added together come to slightly more.
JCODE, the US Joint Criminal Opioid and Darknet Enforcement team, is calling this its largest action to date. It follows the same template as DisrupTor in 2020, Dark Hunter in 2021, SpecTor in 2023 and RapTor in 2025: seize a darknet market, sit on the data, work it quietly for a year or more, then announce a batch of arrests.
The trend line Europol draws
The release ends with the familiar assessment. Darknet markets are fragmenting into platforms that specialise in one criminal activity, forums and end-to-end encrypted messaging are blending into a hybrid ecosystem, and disrupted darknet markets are replaced quickly. Europol calls it resilience. From the outside it looks more like a conveyor belt that keeps producing new domains while the old order books keep producing evidence.
The practical read for anyone who used those darknet markets is not that the site is gone so the risk is gone. It is the reverse. Assume the history is still being read, and that the gap between a seizure and an arrest can be measured in years.