59 UK Arrests as Operation TorNado Exposed 5 Dark Web Networks

An international operation targeting dark-web drug markets has led to 354 arrests across 14 countries, including 59 in the United Kingdom. Authorities say investigators identified people behind online vendor and buyer accounts, seized more than 5.7 tonnes of illicit drugs and recovered 209 firearms.

The operation, known as Operation TorNado, ran from May 2025 to October 2026. It involved law enforcement agencies coordinated with Europol and the US Department of Justice’s Joint Criminal Opioid and Darknet Enforcement team, known as JCODE.

The results show how investigations can continue long after an online criminal marketplace has been taken offline. Rather than simply closing websites, authorities used intelligence from earlier marketplace seizures and separate investigations to identify people suspected of operating or buying through these networks.

Why investigators returned to five seized marketplaces

Operation TorNado included follow-up investigations involving five major dark-web marketplaces previously seized by law enforcement: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door.

These were not five new marketplace shutdowns carried out by TorNado. Their earlier takedowns provided investigators with information that could help identify vendors and buyers. US authorities said intelligence obtained after previous marketplace and vendor-target operations led to complementary, but separate, investigations.

Authorities also targeted people active on forums, individual vendor shops and encrypted messaging services. This matters because illegal trading does not necessarily stop when one marketplace disappears. Sellers and buyers may move to other platforms or communicate through different channels.

The public announcements do not provide a complete breakdown showing how many of the 354 arrests came from each marketplace. Nor do they establish that every person arrested was connected to one of the five named platforms.

The UK recorded 59 arrests. The National Crime Agency and National Police Chiefs’ Council are named among the UK participants. Europol also reported that authorities in the UK seized 150 kilograms of ketamine. However, the published information does not establish that this seizure was connected to every UK arrest or to a particular marketplace.

What the operation uncovered

Across the operation, authorities reported the seizure of approximately 5.7 metric tonnes of illicit drugs, 209 firearms and more than $234 million in cash and virtual currencies. The US authorities also reported the seizure of 38 pill presses.

The scale of the seizures varied considerably by region. In the United States, authorities reported approximately 4.8 metric tonnes of drugs, 152 firearms and more than $166 million in cash and cryptocurrency. Across European countries, Europol reported 950 kilograms of illicit drugs, 57 firearms and ammunition, and more than €60 million in cash and cryptocurrencies.

The UK seizure of 150 kilograms of ketamine was among the quantities highlighted by Europol. These figures describe what authorities reported recovering; they should not be read as a measure of the total size of the dark-web drug trade.

The operation also demonstrates why financial investigations matter. Dark-web marketplaces may use cryptocurrency, pseudonymous accounts and services designed to conceal users’ identities, but those measures do not guarantee that transactions cannot be investigated.

Europol said its specialists supported the operation through forensic and blockchain analysis, intelligence sharing and coordination between national investigations. Its SIENA system was used to facilitate information exchange between law enforcement partners. These methods can help investigators connect digital accounts, transactions and other evidence, although a blockchain transaction alone does not prove who controlled a wallet.

IRS Criminal Investigation Chief Jarod Koopman summarised the financial side of the work: “Criminal networks may operate across borders and in the shadows of the Dark Web, but they cannot operate without money.”

DEA Administrator Terrance Cole said the operation demonstrated “the strength of JCODE and our international law enforcement partnerships.”

The authorities have not said that every suspect was identified through the same technique. In practice, investigations can combine information from seized servers, account records, financial analysis, digital devices and evidence gathered through searches. The evidence required to identify and prosecute an individual will depend on the particular investigation.

What this means for dark-web users

The operation is a reminder that online anonymity is not the same as guaranteed anonymity. A person may use a pseudonym, an encrypted messaging service or cryptocurrency, but investigators can sometimes connect online activity to a real individual through evidence gathered from multiple sources.

That does not mean that using the Tor browser is itself a crime. Tor is a privacy technology with legitimate uses, including protecting communications and browsing privacy. The criminal conduct targeted in this operation involved suspected trafficking and the sale of illegal goods and services, not simply the use of privacy software.

Buyers can also face investigation. Operation TorNado explicitly targeted vendors and buyers, not just people running marketplaces. Whether a buyer can be prosecuted depends on what they purchased, the relevant law and the evidence available in that case. An arrest does not, by itself, establish guilt.

Nor does the operation mean that the dark web has been shut down. The dark web is a broad part of the internet accessed through specialised software and networks. Authorities targeted particular criminal activity and the people suspected of participating in it. Other services and marketplaces may continue to operate or emerge.

The investigations are not all over. US authorities said work is continuing to identify individuals behind dark-web accounts. A further announcement on 13 November described two investigations in the US state of Georgia associated with Operation TorNado, illustrating that casework and prosecutions can continue after the headline arrest figures are released.

The 354 figure refers to arrests, not convictions. The public announcements do not establish that everyone arrested has been charged or found guilty.

For ordinary internet users, the announcement is not evidence that their personal accounts or data have been breached. The public statements focus on dark-web criminal networks, drug trafficking and related offences; they do not report a general compromise of ordinary users’ personal accounts.

The important distinction is between privacy tools and criminal activity. Privacy technology is not proof of wrongdoing, cryptocurrency is not automatically untraceable, and an online identity does not necessarily shield someone from an investigation. At the same time, each suspect’s responsibility must be established through evidence and the legal process.