Norway arrests 28 in dark web crackdown as Monero tracing becomes law enforcement’s new weapon
Kripos developed new methods to track Monero transactions in 2025, raising fresh questions about the long-term viability of privacy coins as anonymous payment rails.
Norway’s National Criminal Investigation Service, known as Kripos, announced the arrest of 28 men across seven countries following an operation conducted in early June 2026. The suspects allegedly used Monero to pay for access to child sexual abuse material on multiple dark web forums. Three children were safeguarded, and over 460 items were seized, including electronic devices, crypto wallets, and illegal drugs.
The arrests spanned Norway, Sweden, Switzerland, Canada, the Czech Republic, Poland, and Germany. Europol supported the operation, underscoring the kind of multi-jurisdictional coordination that has become increasingly common in dark web takedowns.
How Monero became the payment method of choice, and how that’s changing
Monero sits in a specific corner of the crypto market: privacy coins, designed to obscure sender, receiver, and transaction amount by default. Bitcoin leaves a public trail. Monero, in theory, does not. That’s why it became the preferred currency for illicit dark web transactions.
Kripos developed new methods for tracing Monero transactions in 2025. The agency has not disclosed exactly how those methods work, which is deliberate. But the operational result speaks for itself: 28 arrests across seven countries tied to payments made in a coin that many assumed was beyond reach.
More arrests are expected as the investigation continues, according to Kripos.
One suspect was also reported to have used artificial intelligence extensively to generate illegal material. Some victims were identified as family members of the suspects.
What this means for privacy coins and the investors who hold them
Major exchanges, including Kraken and Binance, delisted Monero in various markets between 2021 and 2023 under regulatory pressure. The Financial Action Task Force has repeatedly flagged privacy coins as high-risk assets for money laundering and illicit finance.
This operation fits into a broader pattern. The Kidflix takedown and Operation Grayskull in 2025 collectively led to hundreds of arrests globally and relied heavily on forensic crypto analysis.