Norway’s National Criminal Investigation Service, known as Kripos, says 28 men have been arrested across seven countries in an international dark web operation tied to Monero payments.
According to the official Kripos announcement, the suspects allegedly used the privacy-focused cryptocurrency Monero to buy access to dark web forums containing child sexual abuse material or other illegal material sexualizing children.
The arrests took place in Norway, Sweden, Switzerland, Canada, Czech Republic, Poland, and Germany. Kripos said the operation was carried out in early June and was coordinated with help from Europol and Eurojust.
A key detail in the case is Monero tracing. Kripos said it developed a method in 2025 that makes it possible to trace Monero use in specific cases. The agency has not disclosed how the method works, but said it was used in this operation to identify people who allegedly paid for access to the forums.
Kripos also said investigators identified two suspected sellers of illegal abuse material, neither of whom are located in Norway. Police seized more than 460 items, including electronic devices, storage media, crypto wallets, illegal material, drugs, and large amounts of doping substances.
The investigation is still ongoing. Kripos said there are many suspects in the case and that more arrests are expected, potentially in additional countries.
In Norway, two people were identified and one man in his 30s from Trøndelag was arrested. During searches, police also implemented measures to protect three children who were present.
The case is notable because Monero has long been treated by criminals as a more private payment rail than Bitcoin. This does not mean Monero is universally broken or that every transaction can be traced. But the operation shows that law enforcement agencies are continuing to develop targeted methods for investigating privacy coin usage in specific criminal cases.
For dark web users relying on privacy coins as a guarantee of anonymity, the message is clear: operational security failures, forum records, payment patterns, device seizures, and investigative coordination can still create an attribution trail.
