Europol

Europol, in collaboration with law enforcement agencies from 14 countries across the globe, have successfully identified vendors and buyers from major dark marketplaces as part of Operation TorNado, a coordinated international effort targeting cybercrime, drug trafficking, and firearms offences. The operation, which spanned from May 2025 to October 2026, resulted in 354 arrests and hundreds of house searches worldwide.

Operation TorNado, which builds on the successes of major operations such as RapTor (2025), SpecTor (2023), Dark Huntor (2021), and DisrupTor (2020), focused on disrupting criminal networks operating on the dark web. This effort included a follow-up action focused on the identification of suspects after the takedown of five major dark marketplaces: Archetyp, Bohemia, Nemesis, Kingdom, Tor2Door

Additionally, law enforcement targeted vendors and buyers active on forums, single-vendor shops, and encrypted messaging services. National authorities conducted independent investigations with Europol’s support, including cross-checks via SIENA and forensic analysis.

In European countries, authorities seized 950 kilograms of illicit drugs in total. The largest quantities were amphetamines (150 kilograms in Germany, ketamine (150 kilograms in the United Kingdom), MDMA (40 kilograms in the Netherlands), cannabis (50 kilograms in France), as well as cocaine.

Seizures also include psilocybin mushrooms (so-called magic mushrooms), vapes containing the cannabinoid Tetrahydrocannabinol (THC), as well as more than one million prescription tablets. Furthermore, 57 firearms and ammunition were seized, along with over EUR 60 million in cash and cryptocurrencies. In the United States, over 4.8 metric tonnes of illicit drugs, 152 firearms and over EUR 150 million (USD 166 million) were seized in cash and cryptocurrencies.

Europol played a central role in Operation TorNado by providing on-the-spot support through deployments in Czechia and Slovenia, ensuring seamless coordination and real-time intelligence sharing. The Agency facilitated case coordination and deconfliction to prevent overlapping investigations, while its forensic and blockchain analysis teams traced illicit transactions and uncovered critical evidence. Additionally, Europol’s analysis and cross-matching capabilities helped identify key targets and dismantle criminal networks operating across borders.

The operation highlighted the evolving resilience of dark web marketplaces, which continue to adapt despite takedowns. As outlined in Europol’s Internet Organised Crime Threat Assessment (IOCTA) 2026 , key trends observed include:

Fragmentation of marketplaces, with platforms specialising in specific criminal activities.

Hybrid ecosystems, where dark web forums and encrypted messaging services (E2EE) blur the lines between surface and dark web communication.

Rapid replacement of disrupted markets, as criminals quickly migrate to new platforms.

Australia : Australian Federal Police (AFP)

Austria : Criminal Intelligence Service Austria with various Provincial Criminal Police Offices (Bundeskriminalamt und Landeskriminalämter)

Czechia : National Drug Headquarters – Criminal Police and Investigation Service (Národní protidrogová centrála SKPV PČR); General Directorate of Customs (Generální ředitelství cel)

Finland : Finnish Customs (Tulli)

France : National Gendarmerie (Gendarmerie Nationale)

Germany : Federal Criminal Police Office (Bundeskriminalamt); General Prosecutor’s Office in Frankfurt am Main – Central Office for Combatting Cybercrime (Generalstaatsanwaltschaft Frankfurt am Main – Zentralstelle zur Bekämpfung der Internetkriminalität); Prosecutor’s Office in Cologne – Central Cybercrime Point (Staatsanwaltschaft Köln – Zentral- und Ansprechstelle Cybercrime); Central Criminal Investigation in Oldenburg (Zentrale Kriminalinspektion Oldenburg); various police departments (Dienststellen der Länderpolizeien); German Customs Investigation Offices (Zollfahndungsämter)

Hungary : National Bureau of Investigation and several police departments (Nemzeti Nyomozó Iroda)

Ireland : Garda National Cyber Crime Bureau (An Garda Síochána)

Montenegro : Police Directorate of Montenegro (Uprava policije Crne Gore)

Netherlands : Team High Tech Crime (National Investigations and Special Operations (NIS) and Post Interventie Team (PIT); National Intelligence, Expertise and Operational Support (NIEO)

New Zealand: New Zealand Police (Ngā Pirihimana o Aotearoa)

Slovenia : Illicit Drugs Section in Criminal Police Directorate (Uprava kriminalistične policije), General Police Directorate in cooperation with the Criminal Police Directorate in Maribor (Policijska uprava Maribor)

United Kingdom : National Crime Agency (NCA); National Police Chiefs’ Council (NPCC)

United States : Department of Justice (DOJ) with the JCODE partner agencies (Federal Bureau of Investigation (FBI); Drug Enforcement Administration (DEA); Food and Drug Administration (FDA) – Office of Criminal Investigations; Homeland Security Investigations (HSI); Internal Revenue Service (IRS) – Criminal Investigation; US Postal Inspection Service (USPIS); Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF); Army Criminal Investigation Division (Army-CID); Customs and Border Protection (CBP); Department of Justice (DOJ); Department of the Treasury Financial Crimes Enforcement Network (FinCEN); Department of the Treasury Office of Foreign Assets Control (OFAC); Naval Criminal Investigative Service (NCIS)