Europol, in collaboration with law enforcement agencies from 14 countries across the globe, have successfully identified vendors and buyers from major dark marketplaces as part of Operation TorNado, a coordinated international effort targeting cybercrime, drug trafficking, and firearms offences. The operation, which spanned from May 2025 to October 2026, resulted in 354 arrests and hundreds of house searches worldwide.

Operation TorNado, which builds on the successes of major operations such as RapTor (2025), SpecTor (2023), Dark Huntor (2021), and DisrupTor (2020), focused on disrupting criminal networks operating on the dark web. This effort included a follow-up action focused on the identification of suspects after the takedown of five major dark marketplaces:

• Archetyp
• Bohemia
• Nemesis
• Kingdom
• Tor2Door

Additionally, law enforcement targeted vendors and buyers active on forums, single-vendor shops, and encrypted messaging services. National authorities conducted independent investigations with Europol’s support, including cross-checks via SIENA and forensic analysis.

Seizures

In European countries, authorities seized 950 kilograms of illicit drugs in total. The largest quantities were amphetamines (150 kilograms in Germany, ketamine (150 kilograms in the United Kingdom), MDMA (40 kilograms in the Netherlands), cannabis (50 kilograms in France), as well as cocaine.

Seizures also include psilocybin mushrooms (so-called magic mushrooms), vapes containing the cannabinoid Tetrahydrocannabinol (THC), as well as more than one million prescription tablets. Furthermore, 57 firearms and ammunition were seized, along with over EUR 60 million in cash and cryptocurrencies. In the United States, over 4.8 metric tonnes of illicit drugs, 152 firearms and over EUR 150 million (USD 166 million) were seized in cash and cryptocurrencies.

Europol’s role

Europol played a central role in Operation TorNado by providing on-the-spot support through deployments in Czechia and Slovenia, ensuring seamless coordination and real-time intelligence sharing. The Agency facilitated case coordination and deconfliction to prevent overlapping investigations, while its forensic and blockchain analysis teams traced illicit transactions and uncovered critical evidence. Additionally, Europol’s analysis and cross-matching capabilities helped identify key targets and dismantle criminal networks operating across borders.

Emerging trends in dark web criminality

The operation highlighted the evolving resilience of dark web marketplaces, which continue to adapt despite takedowns. As outlined in Europol’s Internet Organised Crime Threat Assessment (IOCTA) 2026, key trends observed include:

• Fragmentation of marketplaces, with platforms specialising in specific criminal activities.
• Hybrid ecosystems, where dark web forums and encrypted messaging services (E2EE) blur the lines between surface and dark web communication.
• Rapid replacement of disrupted markets, as criminals quickly migrate to new platforms.