Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
⚡ Why it matters
It shows dark web anonymity has limits. Data seized from shuttered markets keeps exposing users years later.
Operation TorNado ran from May 2025 to October 2026 and involved law enforcement in 14 countries. It targeted vendors and buyers on dark web markets as well as forums, single-vendor shops and encrypted messaging services.
The results
- Europe: over €60 million in cash and crypto, 950 kg of drugs and 57 firearms seized.
- United States: over 4.8 tonnes of drugs, 152 firearms and more than €150 million seized.
The US Justice Department said intelligence from earlier JCODE marketplace takedowns helped identify traffickers and led to a series of separate investigations. Europol noted that these markets keep adapting and coming back despite takedowns.
Part of a long series
TorNado follows DisrupTor in 2020 (179 arrests), Dark HunTor in 2021 (150 arrests) and SpecTor in 2023 (288 arrests), plus the 2022 takedown of Hydra, the largest market of its time.
Why defenders should care
Dark web markets sell more than drugs. They also trade stolen credentials, hacking tools and initial access to companies. Every takedown raises the cost of cybercrime and can expose wider networks.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.
Osaka Data Breach Exposes 1M Emails via Arara Hack
The city of Osaka says more than 1 million email addresses of its online services users leaked after hackers breached Arara, the email delivery service used by its platform vendor TKC.