The US Department of Justice (DOJ) and Europol announced on November 12 that an international operation against dark web drug trafficking has led to 354 arrests and the seizure of more than $234 million in cash and cryptocurrency. The enforcement action, known as Operation TorNado, ran from May 2025 to October of this year and involved law enforcement agencies in 14 countries pursuing drug sellers and buyers operating through dark web marketplaces.

Investigators did not say how much of the $234 million represents drug-sale proceeds, and officials did not disclose the cryptocurrency share of the total. The operation also leaves an open question: whether removing vendors and seizing assets will reduce future sales, or whether the business will simply move to another marketplace.

A record JCODE takedown across four continents

Operation TorNado targeted individuals believed to be engaged in trading drugs via dark web marketplaces — platforms hosted on anonymity networks such as Tor, which route traffic through relays to conceal users' identities and locations. It was the sixth and, to date, largest international effort by the DOJ's Joint Criminal Opioid and Darknet Enforcement (JCODE) team since 2018, according to the DOJ statement, which describes the action as targeting opioid and fentanyl traffickers on the dark web.

The operation built on Operation RapTor in 2025, which drew on evidence gathered from four previously dismantled markets: Bohemia, Nemesis, Kingdom, and Tor2Door. TorNado also targeted vendors and buyers from Archetyp, another marketplace that was dismantled in June 2025.

According to the DOJ, the United States recorded 132 arrests, followed by the United Kingdom with 59, Hungary with 45, Germany with 41, and France with 23. FBI Director Kash Patel highlighted the scale of the operation:

"Operation TorNado is the largest interagency takedown of Dark Web drug vendors and buyers to date."

— Kash Patel, FBI director, in the DOJ statement

Police also seized about 5.7 metric tons of drugs, 209 firearms, and 38 pill presses — machines used to mass-produce pills. Europol, the European Union's law enforcement agency, which coordinated the global crackdown, reported more than €210 million in seized criminal assets.

Beyond the arrests and seizures, Attorney General Todd Blanche argued that the crackdown had dealt a serious blow to vendors operating on these markets:

"Operation TorNado crippled Dark Web market vendors."

— Todd Blanche, U.S. Attorney General, in the DOJ statement

How investigators attributed the accounts

Previous marketplace takedowns provided investigators with a way to track anonymous accounts involved in the drug trade. The DOJ said these leads played a vital role in linking accounts on DrugHub and Archetyp to real people. Europol added, in its Europe-wide takedown announcement, that countries across Europe ran separate investigations using shared intelligence and forensic analysis.

Neither agency claimed that investigators broke Monero's cryptography. Monero is a privacy-focused cryptocurrency designed to conceal the sender, recipient, and amount of a transaction, in contrast to the public ledgers of coins such as Bitcoin. Europol's Internet Organised Crime Threat Assessment (IOCTA) 2026 notes that privacy coins and offshore exchanges make illicit funds harder to trace.

Why the markets keep coming back

Closing a marketplace does not necessarily stop its business. Chainalysis, a blockchain analytics firm, estimated that darknet markets and drug vendors received slightly over $2.5 billion in crypto in 2025, up modestly from 2024. TorZon, for example, gained ground after Abacus Market closed in July 2025.

Europol's IOCTA 2026 describes the same pattern: users move to surviving markets, while new platforms appear after takedowns.

Payment preferences are shifting as well. TRM Labs, a blockchain intelligence company, found that 48% of darknet markets launched in 2025 accepted only Monero (XMR), sharply up from earlier years. That figure covers newly launched markets, not all active ones.

What it means for exchanges and compliance

Monero has held up despite exchange restrictions. TRM Labs found activity still above pre-2022 levels, with liquidity increasingly concentrated offshore or at less-regulated venues. The July 2026 update from the Financial Action Task Force (FATF), the intergovernmental body that sets global anti-money-laundering standards, warns of risks from providers operating without effective oversight.

The earlier RapTor operation brought 270 arrests and more than $200 million in seizures in May 2025; TorNado surpassed both figures. Exchanges still need to monitor exposure to illicit services, but larger seizures alone cannot show whether the underlying trade has shrunk.