Police turn seized dark web market data into arrests across 14 countries

Overview

Updated 11 minutes ago

Police in 14 countries arrested 354 people in a sweep that ran from May 2025 to October 2026, Europol announced on November 12. The operation, called TorNado, did not begin with a new investigation. It began with data seized from five dark web marketplaces that had already been shut down: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door.

That order of events is the mechanism. A takedown removes a storefront. The order logs, vendor messages and cryptocurrency trails left behind identify the people who used it. TorNado is the sixth time Europol and the FBI's Joint Criminal Opioid and Darknet Enforcement team have run that playbook since 2018, and the largest by arrest count.

Why it matters

Police now treat a marketplace takedown as the start of a case, not the end, and the arrests arrive months later.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

354

Arrests

Suspects detained across 14 countries during the operation.

5.7 t

Illicit drugs seized

Global total reported by the U.S. Department of Justice, including fentanyl, methamphetamine and cocaine.

209

Firearms seized

Weapons recovered worldwide, alongside 38 pill presses.

$234M

Cash and cryptocurrency seized

U.S. figure; Europol reports more than €210 million in criminal assets overall.

Countries involved

Agencies in Europe, North America and Oceania took part.

Pill presses seized

Equipment used to stamp counterfeit prescription opioids.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Stanislav Chernyshov

Alleged operator of dark web vendor account 'BarbaraWhite'

Arrested in Florida; charged in the Eastern District of Virginia

Vladislav Chernyshov

Alleged co-operator of the 'BarbaraWhite' vendor account

Arrested in Florida; charged in the Eastern District of Virginia

Christopher Lin

Unit chief overseeing the FBI's JCODE team

Active

Organizations Involved

Europol

International Law Enforcement Agency

Coordinated Operation TorNado

The EU agency that coordinates cross-border police work among member states and partner countries.

Joint Criminal Opioid and Darknet Enforcement (JCODE)

FBI-led interagency task force

Led U.S. side of the operation

A U.S. task force created in 2018 to disrupt opioid sales on dark web markets.

U.S. Department of Justice

Federal agency

Announced U.S. arrests and charges

The federal department that prosecutes U.S. cases arising from the operation.

Timeline

2018 November 2026

7 events Latest: 2 days ago

Tap a bar to jump to that date

November 2026
Results announced: 354 arrests
Latest Statement

Europol, the Justice Department and the FBI report arrests in 14 countries, 5.7 tonnes of drugs, 209 firearms and about $234 million in assets.
2 days ago
May 2025
TorNado begins
Investigation

Investigators start working through data from Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door, plus forums and encrypted messaging services.
May 2025
2025
Operation RapTor produces leads
Investigation

The prior year's action generates intelligence that TorNado investigators build on.
2025
2023
Operation SpecTor widens the model
Investigation

Europol and JCODE run another sweep built on data from previously closed marketplaces.
2023
2021
Operation Dark Huntor repeats the approach
Investigation

A third coordinated action follows the same follow-on investigation pattern.
2021
2020
Operation DisrupTor sets the template
Investigation

An earlier joint sweep establishes the model of mining seized market data to identify users after a takedown.
2020
2018
FBI creates JCODE
Policy

The bureau establishes a task force to target opioid sales on dark web markets, working with the DEA and postal inspectors.
2018

Scenarios

Second wave of arrests follows from the same market data

Likely Resolves by Q2 2027

Discussed by: Europol and the FBI, both of which said investigations remain open in several countries

TorNado's arrests came from data already in hand. Europol and the FBI say more suspects are still being identified from the same material, which means a further announcement is plausible rather than speculative. The trigger is a partner country finishing its attribution work and moving to arrest.

Chernyshov brothers plead guilty or go to trial

Possible Resolves by End of 2027

Discussed by: Justice Department charging documents

The BarbaraWhite case is the operation's most detailed public example, and it now moves through the Eastern District of Virginia. A guilty plea would close it quickly; a trial would test how well the digital and lab evidence ties a vendor account to two named people.

Replacement markets absorb the demand and the effect fades

Uncertain Resolves by End of 2027

Discussed by: Europol's Internet Organised Crime Threat Assessment

Europol's own threat assessment describes dark web markets fragmenting into specialist platforms and being replaced quickly after disruptions. If that pattern holds, TorNado removes people without removing the market, and the next assessment will show availability recovering.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

September 2020

Operation DisrupTor (2020)

Europol and JCODE ran one of the first coordinated sweeps aimed at dark web opioid sellers, built on data from marketplaces that had already been closed. It established the sequence that later operations follow: shut a market, then work backward through its records.

Then

Arrests and seizures across the United States and Europe.

Now

The follow-on investigation became the standard method rather than an improvisation.

Why this matters now

TorNado is the same method at larger scale, which is why its arrest count reflects old data more than new police work.

2023

Operation SpecTor (2023)

A European-led sweep extended the model to more countries and more marketplaces, with Europol coordinating cases so national investigations did not overlap.

Then

Coordinated arrests and asset seizures across multiple jurisdictions.

Now

Deconfliction and intelligence sharing became routine parts of the process.

Why this matters now

TorNado's 14-country structure and Europol's coordination role were tested in SpecTor first.

2025

Operation RapTor (2025)

The immediate predecessor to TorNado, which the Justice Department describes as building on last year's action. Data and leads from RapTor fed directly into the TorNado investigations.

Then

A fresh set of vendor identifications and case files.

Now

Each operation now seeds the next, making the series cumulative rather than episodic.

Why this matters now

TorNado is not a standalone event. It is the latest installment in a chain where one year's seizures become the next year's arrests.