Operation TorNado: 354 Arrests, More Than $234M in Drug Seizures

By Nathan Brooks

The U.S. Department of Justice said on November 14 that Operation TorNado led to 354 arrests worldwide and seizures of more than $234 million in criminal proceeds, including cryptocurrency and cash.

The action covered the United States, Europe, Australia and New Zealand, according to DOJ. The department described TorNado as a joint international investigation conducted with Europol and other agencies. Alongside the financial seizures, investigators recovered about 5.7 tons of illegal drugs and 209 firearms.

FBI Director Kash Patel called TorNado "the largest coordinated enforcement action ever targeting dark web drug sellers and buyers." He said: "Technology and geography cannot shield criminals from law enforcement." Together, the statements frame the operation as a coordinated disruption of dark web commerce rather than a single-country prosecution.

DOJ said investigators targeted groups and related offenders accused of selling illicit drugs, including fentanyl and heroin, through the dark web. The operation also arrested vendors active on DrugHub, a marketplace used by dark web drug-trafficking groups that accepted Monero (XMR) as its sole payment method.

What does the DrugHub enforcement change for vendors?

The practical change is evidentiary. A DrugHub vendor arrest ties accused conduct to a named marketplace and defined payment arrangement, rather than to illicit online activity in general. A subset of the 354 arrests involved DrugHub vendors; DOJ did not state that number, identify defendants or charges, or explain how investigators linked the arrests to the platform.

For vendors and investigators, that narrower record still carries an operational message: international coordination can tie arrests to specific commercial infrastructure. It does not establish that every dark web transaction is traceable or that technology alone determines enforcement outcomes.

DOJ named the people and groups accused of trafficking drugs as the targets, not the payment technology as such. The announcement therefore describes action against users of criminal infrastructure, not a general intervention in Monero.

A single payment asset is not a protocol case.

Monero enters the announcement because DrugHub used XMR as its only payment method. DOJ did not allege in the summary that the Monero protocol, its developers or its broader user base had been compromised or targeted. For market participants, the record should not be read as evidence that holding or using XMR creates a general enforcement risk.

The documented arrests concern vendors active in a drug-trafficking marketplace. The practical distinction is between an operation against a marketplace’s users and an action against the underlying protocol. TorNado supports the former description; DOJ’s announcement does not support the latter.

The $234 million is a combined asset figure.

The announced haul included both cryptocurrency and cash, and DOJ did not identify the digital assets or publish the cryptocurrency share. The number therefore cannot be treated as a crypto-only seizure total. For crypto market participants and compliance teams, the figure represents a mixed enforcement haul, not a valuation of the hidden market.

The physical seizures widen the operation’s scope. About 5.7 tons of illegal drugs and 209 firearms show that investigators worked beyond online storefronts and payment records, reaching recovered contraband and physical goods. That combination supports the enforcement logic cited by Patel: identify offenders across jurisdictions, arrest participants across borders, and seize available assets and contraband.

The headline figures also require careful denominators. The 354 arrests count enforcement actions, not marketplaces or transactions. The $234 million measures seized criminal proceeds, not total drug-market revenue. The 5.7 tons and 209 firearms describe recovered physical items, not total inventories in circulation. Without defendant-level records, no reliable per-arrest or per-vendor loss can be calculated from the announcement.

The operation also shows that international enforcement can reach a Monero-only marketplace. The DOJ announcement describes no separate technical action against Monero. The case therefore supports a narrower conclusion than claims of universal crypto traceability: investigators can combine international police work, marketplace evidence and seizures, while the public announcement stops short of explaining the digital forensic steps.

DOJ did not disclose DrugHub’s operating status, any changes in platform use or how it identified digital assets. Those omissions limit any claim about market migration or the scalability of the operation. They also leave the practical structure of DrugHub’s post-operation activity unresolved.

The next verifiable checkpoint is the release of country-level charging and forfeiture records; until then, the combined seizure figure, DrugHub’s operating status and the cryptocurrency share of proceeds remain unresolved.