Operation TorNado Seizes $234 Million, 354 Arrests Across 14 Countries

US authorities and international partners seized roughly $234 million in cash and crypto and made 354 arrests across 14 countries in Operation TorNado, announced on November 12, 2026. Officials describe it as the largest takedown to date by the Joint Criminal Opioid and Darknet Enforcement (JCODE) team. The operation ran for roughly a year and a half, from May 2025 through October 2026.

The scale of the haul extends well beyond money. Investigators confiscated approximately 5.7 metric tons of drugs — the weight of a loaded delivery van — with fentanyl, the synthetic opioid at the center of the US overdose crisis, accounting for a significant share. They also recovered 209 firearms.

Who carried the enforcement load?

The United States did the heaviest lifting. American authorities made 132 arrests, seized 4.8 metric tons of drugs and confiscated $166 million in assets domestically — roughly 71 percent of the total asset seizure. Europe accounted for much of the remainder, with law enforcement there seizing nearly 1 metric ton of drugs and more than €60 million in cash and crypto.

Arrest counts outside the US were distributed across several jurisdictions:

• United Kingdom: 59 arrests
• Hungary: 45 arrests
• Germany: 41 arrests

The operation's stated focus was opioid trafficking networks whose customer base reportedly reached tens of thousands of American buyers. That figure, if accurate, suggests demand-side enforcement could not plausibly capture every participant; the arrests represent a fraction of the buyers authorities say existed. In plain words: enforcement reached far, but not as far as the market it targeted.

Why did TorNado target buyers as well as vendors?

The operation departed from a vendors-only posture. TorNado pursued both sellers and buyers active on dark web marketplaces that law enforcement had previously compromised. That detail is the operational core of the story: arrests followed from intelligence gathered on marketplaces investigators already controlled.

It also carries a message. Buyers who assumed marketplace activity was low-risk were, in these cases, transacting on infrastructure that had been penetrated. The anonymity premise, in this instance, failed quietly and in advance of the arrests.

Is this a one-off crackdown?

No. TorNado builds directly on two earlier JCODE operations: SpecTor in 2023 and RapTor in 2025. Each followed a similar template — international coordination, marketplace infiltration and mass arrests. The pattern suggests a repeatable methodology rather than a lucky break, and it implies future operations of the same shape are likely.

The caveat deserves weight, though. The research behind the outcome flags a persistent concern: dark web marketplaces have a track record of adapting after each crackdown. Three operations in three years has not ended the trade; displacement to new venues remains the observed pattern. In plain words: enforcement is getting better at the chase, but the market keeps finding new places to run.

What does this mean for crypto tracing?

Crypto sits at the center of this story because it is a core part of how darknet markets function — payments, not incidental. The size of the seizure — $234 million across cash and digital assets, pooled from 14 countries — points to a reality that privacy-minded users sometimes underestimate. Funds on a public blockchain leave a trail, and authorities across multiple jurisdictions have clearly grown comfortable following it.

The research accompanying the report frames the outcome as evidence that law enforcement is becoming more effective at tracking and disrupting financial flows tied to drug trafficking. That claim is plausible on these numbers, but it rests on seizures, not convictions; asset forfeiture counts are announced loudly, while case outcomes down the line rarely receive equivalent attention. In plain words: the money was taken, but what the courts ultimately decide is the part that is not yet said.

The operational takeaway for compliance and policy observers is straightforward. Cross-border coordination under JCODE now functions as a standing capability, not an occasional surge. Anyone transacting on compromised marketplaces or relying on public-chain opacity for illicit purposes faces a demonstrated, multi-year enforcement window — and the next iteration of this template is a question of when, not whether.