The U.S. Department of Justice and Europol announced the results of the international TorNado operation targeting networks trafficking fentanyl, opioids, and other drugs via the darknet. Law enforcement agencies from four regions of the world detained 354 suspects and seized more than $234 million in cash and cryptocurrencies.
According to the US Department of Justice, it lasted from May 2025 to October 2026. It became the sixth international campaign of the Joint Criminal Opioid and Darknet Enforcement (JCODE) team, created in 2018, and the largest in scale in its history.
The US exposed a drug trafficking network via the darknet with laundering of cryptocurrency proceeds
16.07.2026
Read
The operation demonstrated how the analysis of blockchain transactions helps identify the real participants of illegal networks that use digital assets for payments.
Investigators worked against sellers and buyers who used, in particular, the Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door platforms.
"Operation TorNado has effectively paralyzed the activities of vendors on darknet markets and will help bring suspected drug traffickers to justice," said U.S. Attorney General Todd Blanche.
Law enforcement officers seized cryptocurrency and 5.7 tons of drugs
Overall, within the framework of the operation, law enforcement officers:
- 354 suspects were detained in the USA, European countries, Australia, and New Zealand;
- seized over $234 million in cash and virtual currencies;
- confiscated approximately 5.7 tons of drugs, including fentanyl, other opioids, methamphetamine, heroin, cocaine and MDMA;
- seized 38 presses for making pills and 209 units of firearms.
The largest number of detentions occurred in the USA — 132. In the United Kingdom, 59 people were arrested, in Hungary — 45, in Germany — 41, in France — 23. Detentions also took place in the Netherlands, New Zealand, Slovenia, Austria, the Czech Republic, Ireland, Finland, and Australia.
FBI Director Kash Patel called TorNado the largest interagency operation against drug sellers and buyers on the darknet. According to him, it also demonstrated how law enforcement cyber capabilities help counter criminal networks operating across borders.
Blockchain analytics helped expose drug sellers
Particular attention was drawn to the case of two brothers from the state of Florida — Stanislav and Vladyslav Chernyshov. They are suspected of operating the darknet shop BarbaraWhite, which sold counterfeit oxycodone pills containing nitazenes — synthetic opioids potentially no less dangerous than fentanyl.
According to Chainalysis, the store had operated since at least 2020 on the Nemesis, Bohemia, and Abacus platforms. Based on data from just three marketplaces, the vendor sold more than 95,000 counterfeit pills. According to the company's estimate, the network's activities are linked to at least 12 cases of overdose, including three fatal ones.
More than $234M in cash and crypto was seized in Operation TorNado, the DoJ and Europol announced today.
The operation led to dozens of federal prosecutions, including the arrest of two brothers in Florida accused of operating “BarbaraWhite,” a darknet vendor that distributed counterfeit pills containing highly potent nitazenes.
In this case, blockchain intelligence helped link a darknet drug operation to its alleged operators, a network associated with at least 12 overdoses and three deaths across the U.S.
Our Reactor graph below illustrates how funds moved between certain wallets linked to BarbaraWhite and other addresses associated with potential buyers and fellow vendors.
— Chainalysis (@chainalysis) November 12, 2026
Blockchain analytics helped investigators trace the movement of funds from sales on darknet platforms to wallets linked to the suspects. In particular, researchers identified about $220,000 in receipts from marketplaces and approximately $230,000 in outgoing cryptocurrency transfers.
Among the recipients were a postal service, another drug seller, and a Chinese supplier of chemicals. According to the investigation, about $7,210 was transferred to the latter.
These transactions helped establish links between the BarbaraWhite crypto wallets and other addresses that investigators linked to the mobile payment account of Stanislav Chernyshov.
The US Department of Justice noted that investigations into some darknet accounts are ongoing. Among other cases — the arrest of the STARLABS vendor, who, according to the investigation, used the DrugHub marketplace with Monero-only support, as well as the exposure of networks distributing heroin, fentanyl, and counterfeit medicines.
“Criminals may operate in the shadows, but they cannot hide from justice,” said Acting Deputy Executive Associate Director of Homeland Security Investigations John Condon.
Recall that earlier, TRON, Tether, and Chainalysis announced the creation of a joint initiative to combat illegal activity in the crypto industry.