The Justice Department and Europol said Thursday that Operation TorNado has produced 354 arrests and the seizure of more than $234 million in cash and virtual currencies, in what the FBI called the largest takedown yet of dark web drug vendors and buyers.
The announcement came from the department’s Joint Criminal Opioid and Darknet Enforcement team, or JCODE, an FBI-led group created in 2018. Officials said Operation TorNado is the sixth, and most extensive, internationally coordinated action since then, and that it builds on last year’s Operation RapTor. The sweep ran from May 2025 to October 2026.
Europol, which coordinated work with agencies in 14 countries, published a parallel statement the same day. The operation targeted vendors and buyers who had been active on five dark web markets already seized by law enforcement: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. Officials also identified accounts on DrugHub and on forums, single-vendor shops and encrypted messaging services.
The seizures included about 5.7 metric tons of illicit drugs worldwide, among them fentanyl and other opioids, methamphetamine, heroin, cocaine, ecstasy and MDMA, plus 38 pill presses and 209 firearms. Neither the Justice Department nor Europol split the $234 million between cash and cryptocurrency, and neither named bitcoin or any other coin in the official totals.
Europol put the European share at more than €60 million in cash and cryptocurrencies, alongside 950 kilograms of drugs and 57 firearms, and the U.S. share at more than €150 million, or $166 million, in cash and cryptocurrencies, plus more than 4.8 metric tons of drugs and 152 firearms. Those regional money figures still combine cash and crypto. Europol said its forensic and blockchain analysis teams traced illicit transactions as part of the work.
Individual cases point to Monero and bitcoin
The closest official window into how the vendors were paid comes from the cases the Justice Department highlighted and from court papers posted with the announcement.
Alexander Green, 32, of Jacksonville, North Carolina, was arrested in June and charged in the Southern District of Ohio with conspiracy to distribute controlled substances, including fentanyl. The department said he allegedly operated a vendor called STARLABS on DrugHub, which it described as a Monero-only dark web market, and that the group has been linked to two overdose deaths. A criminal complaint says undercover purchases from STARLABS were made “in exchange for cryptocurrency.” If convicted, he faces up to 20 years in prison.
In a separate Florida arrest, brothers Stanislav Chernyshov, 30, and Vladislav Chernyshov, 35, are charged in the Eastern District of Virginia with conspiracy to distribute Schedule I synthetic opioids. Prosecutors say they allegedly ran the vendor “BarbaraWhite,” selling counterfeit oxycodone pills laced with nitazenes and shipping more than 1,000 parcels across 49 states. A search-warrant affidavit describes bitcoin transfers tied to that account and the Nemesis market. They each face up to 20 years if convicted.
132 arrests in the United States, and more work ahead
Operation TorNado led to 132 arrests in the United States, 59 in the United Kingdom, 45 in Hungary and 41 in Germany, along with arrests in France, New Zealand, the Netherlands, Slovenia, Austria, Ireland, Czechia, Australia and Finland. A number of investigations are still ongoing to identify the people behind remaining dark web accounts, the department said.
FBI Director Kash Patel called Operation TorNado “the largest interagency takedown of Dark Web drug vendors and buyers to date.” IRS Criminal Investigation Chief Jarod Koopman, whose agency was part of the JCODE group, put the financial work at the center: “Criminal networks may operate across borders and in the shadows of the Dark Web, but they cannot operate without money.”
Federal prosecutions are underway in more than 20 districts. An indictment or complaint only alleges that crimes were committed, and the defendants are presumed innocent until proven guilty.
What the announcement does not settle is how much of the $234 million was cryptocurrency, and how much of that was bitcoin. Officials have not said. The record on Operation TorNado shows a combined cash-and-crypto seizure, a Monero-only market in at least one featured case, and bitcoin transfers in court papers, without a breakdown of the total.
