Five and a Half Tons of Dark Web Drugs, 354 Arrests, and the Part of the Market That Never Closes

The Department of Justice announced Thursday that a year and a half of coordinated work against darknet drug vendors had ended in 354 arrests across 14 countries, the seizure of roughly 5.7 metric tons of drugs, $234 million in cash and cryptocurrency, 209 firearms and 38 pill presses. Attorney General Todd Blanche credited the Joint Criminal Opioid and Darknet Enforcement team, known as JCODE, and Europol. FBI Director Kash Patel called it "the largest interagency takedown of Dark Web drug vendors and buyers to date."

Read the country breakdown and a different story emerges than the one the headline numbers suggest. Of those 354 arrests, 132 were in the United States and 59 in the United Kingdom, with the rest spread across Germany (41), Hungary (45), France (23), New Zealand (13), the Netherlands (12), Slovenia (11), Austria (6), Ireland (5), Czechia (4), Australia (2) and Finland (1). The operation ran from May 2025 through October 2026. Twenty-plus federal districts have open prosecutions. A number of investigations, the department said, are still running.

That is a supply-side scoreboard, and an unusually detailed one. What it does not contain is any figure for how many of the parcels shipped from these vendors reached someone who is still alive today, or how many of the buyers were people with an opioid use disorder who are now, functionally, back in the same market with a different vendor's name in the address bar.

What the storefronts were

JCODE has been running these operations since 2018, and TorNado is the sixth. Each one builds on the marketplaces seized in the previous round, because a seized marketplace is not a dead end — it is an evidence locker. The department named the markets whose vendor and buyer accounts fed this operation: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. All five had been taken down previously. TorNado was built from the intelligence they left behind.

One market that appears in the case files was not described as seized: DrugHub, which the release identifies as a Monero-only marketplace. Monero is a privacy coin designed to defeat blockchain tracing, and its use is why one of the five individual cases the department highlighted reads less like a drug bust than a payment-infrastructure problem.

Alexander Green, 32, of Jacksonville, North Carolina, is accused of running a vendor organization called STARLABS on DrugHub under that moniker. According to the department, his operation is linked to two overdose deaths in the Southern District of Ohio. When agents moved in June 2026, they seized about 200 grams of methamphetamine and more than two kilograms of counterfeit pharmaceutical pills containing fentanyl. He is charged in the Southern District of Ohio; the statutory maximum, if convicted, is 20 years.

A pill press, a mailbox, and 49 states

The case that best explains why darknet enforcement keeps returning to the same problem is the one involving two brothers in Florida. Stanislav Chernyshov, 30, a Russian national living in the country illegally, and Vladislav Chernyshov, 35, a naturalized U.S. citizen, are accused of operating a vendor called "BarbaraWhite" that sold counterfeit oxycodone M30 pills — the blue tablets that are the most widely counterfeited prescription opioid in the country.

The pills were not fentanyl alone. The department says they were laced with nitazenes, a class of synthetic opioids that can equal or exceed fentanyl's potency and that has been showing up in U.S. toxicology reports with increasing frequency. Lab analyses, covert purchases and surveillance tied the brothers to what the release describes as a clandestine pill-manufacturing and nationwide mailing operation responsible for more than a thousand parcels shipped across 49 states, with multiple fatal and non-fatal overdoses identified among recipients.

The arithmetic of a single press

Thirty-eight pill presses were seized across the operation. A pharmaceutical-grade rotary press can turn out tens of thousands of tablets an hour; the benchtop models that circulate in the illicit trade produce far less but cost a few thousand dollars and fit in a spare room. Counterfeit M30 pills pressed from a fentanyl or nitazene blend are the reason public health agencies have spent a decade telling people who use pills that there is no such thing as a pharmacy-grade tablet bought outside a pharmacy.

The other cases the department highlighted follow the same pattern with different chemistry. Jonatan Gonzales, 35, of Bakersfield, California, is accused of running the vendor "SpeedyPharma," shipping methamphetamine, black tar heroin, cocaine and K2 paper to addresses in western Pennsylvania and, the department says, to the other 49 states. A search of his residence turned up 48 pounds of methamphetamine, 588 grams of cocaine, 386 grams of black tar heroin, 3.5 grams of fentanyl, 2.8 grams of carfentanil and $40,565 in cash. He faces a maximum of life in prison if convicted.

A five-defendant cell in New Jersey and the Bronx is accused of running a mail-based distribution network out of Bergen County that moved counterfeit Xanax, MDMA and ketamine; searches in Lodi, Lawrence Township, Bergenfield and Englewood recovered roughly 300 kilograms of the drugs. Eric Turner, 30, of Lizella, Georgia, and Jose Smith, 29, of Valrico, Florida, allegedly sold bulk heroin and fentanyl under the monikers "Postmates" and "FuegoPacksXpress"; their residences yielded 4.5 kilograms of heroin, 22 grams of fentanyl, MDMA, alprazolam tablets and 25 firearms.

Every one of those names comes with the department's standard caveat at the bottom of the release: an indictment is an allegation, and the defendants are presumed innocent.

How this operation compares to the last one

The comparison to Operation RapTor, announced a year earlier, is the most useful measure of whether any of this is working. RapTor produced 270 arrests, more than $200 million in currency and digital assets, over two metric tons of drugs, 144 kilograms of fentanyl or fentanyl-laced narcotics, and more than 180 firearms.

TorNado's totals are larger on every line — 354 arrests against 270, $234 million against $200 million, 5.7 tons against two tons, 209 firearms against 180. The drug tonnage nearly tripled. Read one way, that is a success: more inventory intercepted, more sellers removed. Read another, it is a measure of how much volume now moves through channels that a postal inspector can only sample.

Neither reading is complete without the denominator nobody publishes. Federal seizures are the visible fraction of a market that is designed to be invisible, and the DEA has repeatedly said that the majority of counterfeit pills tested in its laboratories contain a lethal dose of fentanyl. The department's own framing — "significantly disrupted the online opioid trade" — is careful. Disrupted, not closed.

What the buyers in those case files actually need

The five cases above share a detail that is easy to skip: every one of them describes overdoses among recipients. The Chernyshov parcels reached people in 49 states. Green's pills are linked to two deaths in southern Ohio. That means, by the department's own account, that people were buying what they believed to be oxycodone and receiving nitazenes or fentanyl, and some of them died.

For those users, the intervention with the best evidence behind it is not a takedown. It is naloxone in the house, fentanyl test strips where pills are being used, and a treatment system that can start medication for opioid use disorder the same day someone asks for it. Buprenorphine and methadone both reduce overdose mortality substantially, and the 2023 removal of the X-waiver requirement means any clinician with a standard DEA registration can prescribe buprenorphine. The bottleneck is no longer the paperwork; it is whether a person who has just learned that the pill they took was counterfeit knows where to go.

Harm reduction organizations have argued for years that darknet market closures push buyers toward less predictable suppliers rather than toward treatment. There is no controlled evidence for that claim in either direction — it is the kind of question that a market-disruption study could answer and that arrest counts cannot. What the TorNado release documents is displacement in the other direction: the same vendors, the same payment rails, the same mail system, one operation later.

The part that is genuinely new

Two things in the announcement are worth marking. The first is that the Financial Crimes Enforcement Network and the Treasury's Office of Foreign Assets Control are now named JCODE members alongside the FBI, DEA, HSI and the Postal Inspection Service. Following the money through cryptocurrency is what makes a Monero-only vendor case prosecutable at all, and the IRS Criminal Investigation division's chief, Jarod Koopman, framed TorNado in exactly those terms — criminal networks "cannot operate without money."

The second is the sheer number of parallel prosecutions: more than 20 federal districts, from the District of Puerto Rico to the Western District of Wisconsin, plus a Bergen County, New Jersey case handled entirely by local prosecutors. That reflects how the mail-based trade distributes harm. A vendor operating out of a Florida apartment generates indictments in Virginia, Ohio and Pennsylvania because the parcels cross those districts on their way to a mailbox.

What it does not reflect is a treatment system scaled to meet the same geography. The counties where those parcels landed are, for the most part, the same counties that have spent the last three years watching their overdose death curves bend downward for fentanyl while stimulant deaths hold flat or rise. Enforcement can be coordinated across 14 countries in 18 months. A clinic that can see a new patient within a week is still, in much of rural America, not available.

What happens to the market next

The department says investigations continue, and the pattern from five previous JCODE operations suggests what comes next: another announcement, another set of seized markets mined for account data, another round of arrests drawn from the vendors who moved into the space the last operation vacated. The vendor names change. The pill presses get counted again, in slightly larger numbers.

For families trying to read this news for something useful, the practical takeaway sits outside the arrest statistics. Counterfeit pills sold online are the specific product this operation was aimed at, and the specific risk is that a nitazene dose looks identical to an oxycodone dose. Anyone who has bought pills outside a pharmacy should assume the contents are unknown, should not use alone, and should carry naloxone — which reverses opioids but does nothing for cocaine, methamphetamine or the stimulants increasingly found in the same supply. Test strips are inexpensive and detect fentanyl, though not all nitazenes.

The 5.7 tons are gone. The demand that produced them was not addressed by this operation, and no law enforcement operation is designed to address it. That work happens in clinics, emergency departments and treatment programs that still, in most of the country, cannot offer a same-week appointment.