354 dark web vendors and buyers arrested in Operation TorNado
354 dark web vendors and buyers arrested in 14 countries during Operation TorNado.
Europol and law enforcement agencies from 14 countries arrested 354 individuals involved in dark web marketplaces during Operation TorNado, which ran from May 2025 to October 2026. The operation targeted vendors and buyers on five previously shut-down marketplaces (Archetyp, Bohemia, Nemesis, Kingdom, Tor2Door), as well as on forums, single-vendor shops, and encrypted messaging services. The United States led the arrests with 132, followed by the UK with 59, Hungary with 45, and Germany with 41. Significant seizures of drugs, firearms, cash, and cryptocurrency were made in both the US and Europe.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Europol?
Get an email when a new story names Europol, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOperation TorNado demonstrates that even after dark web marketplaces are shut down, law enforcement can continue to identify and arrest participants by leveraging digital evidence, cryptocurrency tracing, and cross-border intelligence sharing. The operation spanned over a year and targeted not just active platforms but also users of previously dismantled ones, showing that anonymity on the dark web is not guaranteed. For organizations, this case reinforces that illicit activity leaves persistent digital footprints — including transaction records, metadata, and communications — that can be reconstructed long after the fact. It also highlights the growing effectiveness of international law enforcement cooperation in combating cybercrime and the importance of monitoring for insider threats or employees who may be engaging in dark web activity.