354 Operation TorNado and buyers arrested in Operation TorNado

Operation TorNado is now the target of an action by Europol.

Europol and police in 14 countries arrested 354 Operation TorNado and buyers in Operation TorNado, which ran from May 2025 to October 2026.

Investigators went after people who had traded on five marketplaces that were already offline: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door.

US authorities seized more than 4.8 metric tonnes of drugs, 152 firearms and over €150 million in cash and cryptocurrency.

In Europe, police seized 950 kilograms of drugs, 57 firearms, more than one million prescription tablets and over €60 million in cash and crypto.

Europol’s 2026 Internet Organised Crime Threat Assessment names the replacement of shut-down markets as a current trend, with criminals moving fast to new platforms.

Past victims of Operation TorNado are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.

The people who used those markets were still exposed after the sites went dark.

An arrest or a seized domain disrupts the operation, but it doesn't undo what already happened to that operation's past victims, and it rarely accounts for every affiliate who can simply rebrand.

This is still an active investigation, not a settled case -- the specifics here may firm up, soften, or change entirely as more comes out.

TorNado follows earlier Europol operations, including RapTor in 2025, SpecTor in 2023, Dark Huntor in 2021 and DisrupTor in 2020.

This action was brought by Europol, which is the body to watch for further updates, with international cooperation across multiple jurisdictions.

Operation TorNado is now dealing with an active legal process, with Europol leading the action.

It also coordinated the national cases so investigators didn’t end up chasing the same suspects twice.

If your environment shows any indicators associated with Operation TorNado, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.

Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.