An international crackdown on darknet drug trafficking has resulted in 354 arrests and the seizure of more than $234 million in cash and cryptocurrency, US and European authorities announced
An international crackdown on darknet drug trafficking has resulted in 354 arrests and the seizure of more than $234 million in cash and cryptocurrency, US and European authorities announced on November 12.
Operation TorNado targeted vendors, buyers and trafficking networks operating through darknet marketplaces. Authorities also seized approximately 5.7 metric tons of drugs, 209 firearms and 38 pill presses.
The financial total combines physical cash and digital assets. Authorities did not identify the entire $234 million as cryptocurrency or attribute that amount to a single criminal network.
Among the cases highlighted was BarbaraWhite, a darknet vendor allegedly operated by two Florida brothers. Blockchain analysis helped investigators connect cryptocurrency transactions to the suspected operators of a network associated with at least 12 overdoses, including three deaths.
Operation TorNado Targeted Networks Across Multiple Countries
The operation ran from May 2025 through October 2026, bringing together investigations across the United States, Europe, Australia and New Zealand.
It was the sixth internationally coordinated action involving the Joint Criminal Opioid and Darknet Enforcement team, known as JCODE, since its creation in 2018. The Justice Department described it as the initiative’s largest and most extensive international operation.
TorNado built on intelligence obtained from earlier marketplace takedowns, including Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. Rather than representing one simultaneous raid, it brought together complementary investigations conducted by different national authorities.
Europol said its contribution included forensic work, blockchain analysis, intelligence sharing and coordination to prevent investigations from overlapping. Authorities also investigated activity involving single-vendor shops, forums and encrypted messaging services.
That broader approach reflects how online criminal networks operate across several platforms. Removing one marketplace can generate evidence for further cases, even when sellers move elsewhere.
Florida Brothers Accused of Operating BarbaraWhite
One investigation involved Vladislav and Stanislav Chernyshov, two brothers from Jacksonville, Florida, accused of operating under the BarbaraWhite vendor name.
Their arrests occurred on August 28, before the November announcement of the wider operation’s results. They were charged with conspiracy to distribute nitazenes, a class of synthetic opioids that can match or exceed fentanyl’s potency.
According to prosecutors, the alleged operation distributed counterfeit oxycodone pills containing these substances. The case was brought in the Eastern District of Virginia. United States Department of Justice
Chainalysis said the vendor had been active since at least 2020 and was linked to at least 12 overdoses across the United States, including three fatalities.
Those associations describe the investigation’s findings and allegations; they should not be presented as a completed criminal judgment against the brothers. The defendants are presumed innocent unless proven guilty.
The case illustrates the consequences behind online transactions: investigators were examining a suspected distribution operation involving dangerous counterfeit medication, rather than cryptocurrency transfers in isolation.
How Blockchain Analysis Helped Investigators Follow the Money
The cryptocurrency component gave investigators another way to examine BarbaraWhite’s activity.
According to Chainalysis, investigators identified Bitcoin addresses allegedly used to withdraw drug-sale proceeds from darknet marketplaces. Analysis of the resulting wallet network helped connect the financial activity to Stanislav Chernyshov.
The company published a recreation of a Reactor graph included in an investigative affidavit. It illustrated transfers between wallets linked to BarbaraWhite and addresses associated with potential buyers and other vendors.
Crucially, blockchain tracing was combined with marketplace information, postal records, surveillance and undercover purchases.
A wallet address is not automatically a verified personal identity. Investigators need supporting evidence to explain who controlled it and what particular payments represented.
Likewise, a transaction involving an address does not, by itself, establish that its owner knowingly participated in a crime.
The significance of blockchain analysis here is its ability to connect financial activity with other evidence. The public record of transfers can help investigators reconstruct relationships that would otherwise remain difficult to examine.
What the Seizure Figures Do—and Do Not—Show
The operation’s headline figures cover numerous investigations and jurisdictions. They should not be confused with the financial activity of BarbaraWhite alone.
In the United States, authorities reported 132 arrests and more than $166 million in combined cash and cryptocurrency seizures. They also seized approximately 4.8 metric tons of drugs, 152 firearms and 38 pill presses.
These figures are components of the wider operation, rather than additional amounts to add to the international total.
The announcement also does not establish that blockchain analysis directly produced every arrest or asset seizure. Different cases involved different evidence and investigative techniques.
Similarly, seized assets are not necessarily the same as assets permanently forfeited following court proceedings. The headline describes what authorities took into custody during enforcement actions, not a final accounting of every prosecution.
Why the Case Matters for Crypto Users and Compliance Teams
For the cryptocurrency industry, TorNado demonstrates how financial tracing can support investigations involving real-world criminal activity.
It also challenges the assumption that using cryptocurrency necessarily makes payments untraceable. In this case, investigators combined Bitcoin transaction analysis with evidence gathered outside the blockchain.
That does not mean every wallet can immediately be identified, or that all cryptocurrencies have identical transparency characteristics. It shows the value of examining transactions within a wider evidentiary context.
Europol warned that darknet markets continue adapting through fragmentation, encrypted communications and migration to replacement platforms. Disrupting their financial networks therefore remains part of a continuing effort, rather than a permanent endpoint.
Authorities said further investigations remain underway. The next stage will involve prosecutions, examination of seized evidence and efforts to identify additional people behind online accounts.
