Forty-one people have been arrested in Germany as part of an international investigation into illegal trade on the darknet . The European Union Agency for Law Enforcement Cooperation, Europol, announced this Europol on 12 November 2026. The Operation TorNado also involved the Central Criminal Investigation Department in Oldenburg . Authorities recorded 354 arrests worldwide.
According to Europol, the operation ran from May 2025 to October 2026. It targeted suspected sellers and buyers of illegal goods, as well as cybercrime and offences involving firearms. Law enforcement agencies from 14 countries took part; hundreds of homes were searched worldwide. The published figures cover the results for the entire period, not those of a single day of action.
In addition to the agency from Lower Saxony the German participants included the Bundeskriminalamt, state police forces and customs investigation offices. Europol also names the Frankfurt am Main Public Prosecutor General’s Office and its Central Office for Combating Internet Crime, as well as a cybercrime specialist unit within the Cologne Public Prosecutor’s Office. Europol’s announcement does not say which specific cases the Oldenburg investigators worked on as part of the operation.
According to the international results, German authorities seized 150 kilograms of amphetamines. Across European countries, the total was around 950 kilograms of illegal drugs. They also seized 57 firearms, along with cash and cryptocurrencies worth more than €60 million. In the United States, the reported quantities were more than 4.8 tonnes of drugs and 152 firearms; more than €150 million in cash and cryptocurrencies was also seized there.
According to Europol, the investigation was partly prompted by the earlier takedown of five major darknet marketplaces, including Archetyp, Nemesis and Kingdom. After they were shut down, authorities focused on identifying suspected users. They also targeted dealers and buyers believed to have been active through forums, individual online shops and encrypted messaging services. Arrests initially indicate a suspicion of criminal activity; the results say nothing about the outcomes of individual criminal proceedings.
National authorities conducted their investigations independently. Europol says it supported them with coordination, information matching and forensic analysis. This also included examining cryptocurrency transactions. Cross-border information-sharing is particularly important in cases of this kind, because platforms, sellers and buyers are not confined to a single country.
Access to the darknet requires special software; its sites are generally not accessible through ordinary search engines. Europol believes that shutting down individual marketplaces does not bring trade there to a lasting end. The agency has observed that listings are becoming more dispersed across specialist platforms and that, after shutdowns, users move to new services. The arrests therefore represent the results of the investigation, but do not show that illegal online trade as a whole has ended.
Editor: Mira Cadena (Article created with AI assistance).