Europol says 354 dark web arrests in Operation TorNado; its own country table adds to 353

The country table adds to 353, one short of the 354 Europol prints (derived)

Europol's release of 12 November 2026 says Operation TorNado "resulted in 354 arrests", and the table under it ends "Total: 354 arrests". Add the 13 country rows that carry a number and the sum is 353 (derived: 1 + 6 + 4 + 1 + 23 + 41 + 45 + 5 + 12 + 13 + 11 + 59 + 132). The fourteenth row, Montenegro, has no number: its footnote says Montenegro conducted one so called knock and talk, which the page defines as a visit to a residence to ask to speak with the occupants. Whether that visit is the missing arrest, the release does not say.

What that does not establish. One arrest is 0.3 per cent of 354 (derived: 1 / 354), so the gap does not show that the operation's real count is wrong. It shows that the page's table and the page's total disagree by one and that the page does not explain it. Counting Montenegro's visit as one would give 354 (derived: 353 + 1), but the page defines a knock and talk as a request to speak with the occupants, not an arrest, so that reading is this site's guess and not Europol's. The same page has a second gap of a different kind: its subtitle says "seize 5 tonnes of drugs", while the seizure paragraphs give 950 kilograms in Europe and over 4.8 metric tonnes in the United States, which add to 5.75 tonnes (derived: 0.95 + 4.8). The EUR 210 million in the same subtitle does match its parts (derived: 60 + 150).

The release does not say how many of the 354 are vendors and how many are buyers, what any of them is charged with, or how many were found through each of the five marketplaces it names. Europol writes and times its own release and credits itself and its partners; the five marketplaces are criminal services, not vendors in the usual commercial sense, and the release names no commercial party.

What the release says happened, in its order

Europol says it worked "in collaboration with law enforcement agencies from 14 countries" and "successfully identified vendors and buyers from major dark marketplaces" in an operation "targeting cybercrime, drug trafficking, and firearms offences". The operation "spanned from May 2025 to October 2026". The release says it builds on RapTor (2025), SpecTor (2023), Dark Huntor (2021) and DisrupTor (2020), and that it "included a follow-up action focused on the identification of suspects" after the takedown of five dark marketplaces: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door.

The page adds that law enforcement also targeted vendors and buyers active on "forums, single-vendor shops, and encrypted messaging services". National authorities ran their own investigations, with Europol's support including "cross-checks via SIENA and forensic analysis". Europol's own part, as it describes it, was "on-the-spot support" through "deployments in Czechia and Slovenia", "case coordination and deconfliction", and "forensic and blockchain analysis teams" that "traced illicit transactions". The release names SIENA but does not expand it; Europol's own SIENA page is linked from the release, and this site did not read it.

What the order leaves open. The page says the five marketplaces were taken down. It does not say when, by which agencies or by what method, and it does not say that the 354 all trace to those five: the same paragraph also names forums, single-vendor shops and messaging services. The operation window is stated in months only. From May 2025 to October 2026 is 17 months by subtraction and 18 calendar months counting both ends (derived). The four earlier operations are given by year alone, so their gaps are 1, 2 and 2 years (derived: 2020 to 2021, 2021 to 2023, 2023 to 2025). TorNado's start month falls in 2025, the year the page gives for RapTor, so the page does not say whether the two operations overlapped.

The release closes with three trends it attributes to Europol's Internet Organised Crime Threat Assessment (IOCTA) 2026: "Fragmentation of marketplaces", "Hybrid ecosystems", and "Rapid replacement of disrupted markets". It frames them as "the evolving resilience of dark web marketplaces". This site did not read the IOCTA report, so it takes the three trends from the release only.

Adding up the arrests table

Fourteen rows, thirteen numbers. The table has 14 rows (derived: count) and the release says 14 countries, so Montenegro counts as a participant: the page's metadata list of participating countries and its list of agencies carry the same 14 names. Because Montenegro prints no arrest number, 13 of the 14 countries carry a number (derived). Finland's row prints one arrest and 159 interrogations; the interrogations are not added to the arrests, and the table sums to within one of 354 without them.

Who accounts for the arrests (derived). The United States row is 132 of 353, or 37.4 per cent (37.3 per cent of the printed 354). The United Kingdom row is 59, or 16.7 per cent on either total. Together they are 191, or 54.1 per cent of 353. The five largest rows, the United States, the United Kingdom, Hungary, Germany and France, sum to 300, or 85 per cent of 353. Grouped by geography, the ten European rows with a number sum to 207 (6 + 4 + 1 + 23 + 41 + 45 + 5 + 12 + 11 + 59) and the United States, New Zealand and Australia to 146 (132 + 13 + 1); 207 + 146 = 353 (derived).

These are shares of reported arrests per participating country. They are not a comparison of how much crime each country has, and the release gives no population, caseload or investigation size to compare against. The United Kingdom's 59 is a participant count in a 14 country table, not a finding about the United Kingdom.

Zoom

Adding up the seizures against the headline

The 5 tonne headline. The subtitle says 5 tonnes and the body adds to 5.75 (derived). The most likely explanation is rounding down, but the release does not say so, and because the United States figure is printed as "over 4.8" the true sum is at least 5.75, so the gap is at least 0.75 tonnes (derived). A reader who quotes the headline number is quoting a figure that the page's own paragraphs do not reproduce.

The dollar figure. The release prints "over EUR 150 million (USD 166 million)" and no exchange rate or date. The two figures imply 1.107 dollars to the euro (derived: 166 / 150 = 1.1067), but both are "over" figures, so that rate is an approximation, and the release does not say that it used one rate on one day. It also does not split cash from cryptocurrencies, which matters because a crypto holding is worth whatever the market says on the day it is valued. The headline's phrase "criminal assets" is wider than the body's "cash and cryptocurrencies".

Where the weight sits (derived, on the printed lower bounds). The United States is 4.8 of 5.75 tonnes of drugs (83.5 per cent), 150 of 210 million euros (71.4 per cent) and 152 of 209 firearms (72.7 per cent), against 37.4 per cent of the arrests. That says the release attributes most of the seized weight and value to the United States row. It does not say the arrests and seizures are linked case by case, and the release does not tie any seizure to any marketplace or to any vendor or buyer.

Named drugs and what is left. The page names four quantities: amphetamines 150 kilograms in Germany, ketamine 150 kilograms in the United Kingdom, MDMA 40 kilograms in the Netherlands and cannabis 50 kilograms in France. They add to 390 kilograms, or 41 per cent of the 950 (derived). The other 560 kilograms (derived) are not itemised: the page adds cocaine, psilocybin mushrooms and vapes containing THC without a quantity. The seizure paragraphs are for "European countries" and for the United States only. Australia and New Zealand, with 14 of the 353 numbered arrests (derived: 1 + 13), have no seizure paragraph, and the release does not say whether their seizures are inside either total or were nil.

Zoom

Words that stand in for counts

Several phrases in the release read as measures and are not. The headline says "354 dark web vendors and buyers arrested", but the table counts arrests by country and the release never separates vendors from buyers, so the headline's two nouns carry no number. The opening says Europol "identified" vendors and buyers, and identification is not arrest: the page does not say how many people were identified and not arrested, other than Finland's 159 interrogations and Montenegro's one visit.

What the release states, and what it does not

What to do, in order (this site's suggestions)

Technical details

The release prints no indicator, hash, domain, onion address, wallet address, command or configuration. It names five marketplaces and no address for any of them, and it names SIENA and blockchain analysis as methods without detail. This briefing therefore prints no indicator. A defender has nothing to hunt from the release itself; the useful artifact is the arithmetic, so a reader can re-run it.

Arrests, 13 rows with a number (derived by this site)
1 + 6 + 4 + 1 + 23 + 41 + 45 + 5 + 12 + 13 + 11 + 59 + 132 = 353
Printed total: 354
Difference: 354 - 353 = 1

Drugs, tonnes (derived)
0.95 (Europe) + 4.8 (United States, printed as over) = 5.75
Headline: 5
Difference: 5.75 - 5 = 0.75, which is 13 per cent of 5.75

Cash and cryptocurrencies, millions of euros (derived)
60 + 150 = 210 (headline: over 210)
166 / 150 = 1.1067 dollars per euro, implied and approximate

Firearms (derived): 57 + 152 = 209
Named drugs, kilograms (derived): 150 + 150 + 40 + 50 = 390; 950 - 390 = 560 not itemised

The question Europol leaves open

If the page's own table adds to 353 and its own paragraphs add to 5.75 tonnes, which numbers is a reader meant to carry away: the headline's, or the ones the page lets you check? And of the 354, how many are the vendors the headline names, how many are buyers, and how many are charged?

Key facts