Europe Calls It Russia’s “Hybrid War”. But Monaco and Nord Stream Make Attribution a Harder Question

Germany’s accusation over Leipzig is not based solely on political rhetoric.

On 1 September, the German government formally concluded that Russia was responsible for the attempted attack on Leipzig/Halle Airport on 4 August. Interior Minister Alexander Dobrindt said the conclusion was based on the combined results of the police investigation, the operational pattern and intelligence findings.

Investigative reporting by NDR, WDR and Süddeutsche Zeitung provides additional detail.

One suspect is reportedly a Belarusian man who also holds a Russian passport. DNA attributed to him was reportedly recovered from a drone, from inside a container holding explosives and from an antenna placed near the airport.

A second suspected operative, described as the operation’s logistics coordinator and instructor, reportedly holds both Latvian and Russian passports. German reporting says investigators identified a connection between one suspect and Russian intelligence.

That makes the proposition that Berlin simply invented the Russian attribution difficult to sustain on the currently published evidence.

But Europe’s wider intelligence picture is not nearly as tidy.

In June, an explosive device in Monaco seriously wounded Ukrainian-born businessman Vadym Iermolaiev, his partner and their child.

Monaco’s prosecutor opened an investigation for attempted murder and the placement of an explosive device. Importantly, prosecutors explicitly said at that stage that they did not have grounds to classify the case as terrorism.

A Ukrainian woman, Anastasiia Berezovska, became the principal suspect. She subsequently returned to Ukraine and was later found shot dead.

Ukraine’s own Security Service then disclosed an extraordinary detail.

According to the SBU, after Berezovska returned to Ukraine she had contact with two men: a former law-enforcement officer and a serving officer of Ukraine’s military intelligence directorate, commonly known as HUR or GUR.

Investigators said both men had repeatedly transferred money to Berezovska’s bank and cryptocurrency accounts and were therefore being examined for possible involvement in the Monaco assassination attempt.

The serving military-intelligence officer also became a suspect in Berezovska’s subsequent killing. He told investigators that he had not informed his superiors about his contacts and payments and had acted on his own initiative.

The SBU said the wider investigation remained ongoing and that the head of military intelligence was assisting it.

That distinction matters.

There is substantial reason to investigate individuals linked to Ukrainian military intelligence.

There is not, on the public evidence currently available, proof that the leadership of HUR ordered the Monaco bombing.

Iermolaiev himself later publicly accused Ukrainian military intelligence of organising the assassination attempt. That remains his allegation rather than a judicial finding.

Then there is Nord Stream.

Here, the allegation of Ukrainian state involvement is much more direct.

German federal prosecutors have charged Ukrainian national Serhii K., whom investigators accuse of helping lead the group that planted explosives on the Nord Stream 1 and Nord Stream 2 pipelines in September 2022.

German prosecutors have said the Ukrainian military personnel involved acted “on the orders of state authorities in Ukraine”.

A second Ukrainian suspect, a trained diver, was arrested in Croatia in August 2026 on a German warrant.

Ukrainian President Volodymyr Zelenskyy denies that the Ukrainian state planned or executed the sabotage.

If the German prosecution’s case survives judicial scrutiny, it would establish something politically uncomfortable: a covert Ukrainian state-directed sabotage operation against critical infrastructure in Europe.

That is highly relevant to how future incidents should be investigated.

It does not, however, prove Ukrainian involvement in Leipzig.

Neither does Monaco.

Neither does corruption inside Ukraine.

Nor does the bitter rivalry among its security agencies.

On 3 September, Zelenskyy announced an investigation following a shootout involving officers from the SBU and HUR in Kyiv that left military-intelligence personnel wounded. It is strong evidence that competition, poor coordination and serious internal problems exist inside Ukraine’s security apparatus. It is not evidence that those agencies staged the Leipzig attack.

The same distinction applies to corruption.

European institutions have both acknowledged progress by Ukraine’s anti-corruption bodies and raised concerns about attempts to weaken their independence and difficulties surrounding high-level corruption investigations. That provides legitimate grounds for scrutiny and external oversight. It does not identify the perpetrators of a particular bombing or drone operation.

An unusual Polish case shows just how complicated attribution can become.

The Guardian examined court records concerning a parcel containing components that could be assembled into a bomb. Polish authorities publicly maintained that the operation originated with Russian intelligence.

Yet the records examined by the newspaper did not themselves establish a Russian link to that particular package. One investigative source suggested that a key intermediary might instead have links to Ukrainian military intelligence and that the material may ultimately have been intended for Russia’s Kaliningrad region.

A Polish security official continued to insist that it was a Russian operation.

The public evidence therefore remains contradictory.

This is the uncomfortable reality of modern covert warfare.

Russia has a documented record of sabotage, cyber operations and destabilisation activity in Europe. The European Union already maintains a dedicated sanctions regime targeting individuals and entities it says are responsible for Russian destabilising operations.

Ukraine, meanwhile, has demonstrated that it possesses sophisticated covert-action capabilities, including operations far beyond the conventional battlefield. The Nord Stream prosecution now raises a direct allegation that Ukrainian state authorities ordered an operation on European territory.

So the correct question after the next explosion, fire or drone incident is not:

Which government do we trust?

It is:

What evidence actually connects the operation to its sponsor?

For Leipzig, the evidence currently made public weighs substantially in favour of the German government’s Russian attribution.

We found no published evidence establishing that the attack was a Ukrainian false-flag operation.

But Monaco and Nord Stream make another conclusion equally important: Ukrainian involvement in a covert operation on European territory cannot responsibly be ruled out in advance simply because Kyiv is an ally.

That is not a pro-Russian argument.

It is the basic standard required when governments begin using words as serious as “hybrid war”.