Polish security chief reports Russia uses cryptocurrencies to pay saboteurs and agents for hybrid attacks on EU countries including drone incursions and sabotage.

Intelligence & EspionageHuman Intelligence (HUMINT)Recruitment of locals

AggressorDefense

Summary

Poland's National Security Bureau head Sławomir Cenckiewicz revealed that Russia is using cryptocurrencies to finance saboteurs and a network of agents involved in hybrid attacks against EU countries. These attacks have included drone incursions into European airspace, sabotage attempts targeting critical infrastructure like water supplies, and hacking operations. Evidence shared with Western intelligence highlights Russia employing its shadow fleet of old oil tankers for drone reconnaissance missions over Poland, Denmark, Germany, and Norway. Recent confrontations include at least 19 Russian drones violating Polish airspace, forcing NATO jets to shoot some down, and drone-induced airport closures in multiple countries. Poland has charged numerous individuals with spying or sabotage linked to Russian GRU intelligence, including a recent arrest of a Ukrainian citizen suspected of smuggling explosives hidden in canned food intended as drone bombs. Legislative efforts are underway in Poland to tighten cryptocurrency regulations in part to disrupt Russian funding channels. Warsaw has also expelled multiple Russian and Belarusian diplomats accused of aiding sabotage plots, with growing reliance noted on ad hoc local agents. The hybrid war extends to the cyber domain, with Poland regarded as being in a state of war with Russia. The broader context involves geopolitical tensions within Poland’s political leadership regarding NATO and EU military alliances.

Classification

Confidence: High

Classified as aggressor because the article details Russian use of cryptocurrencies to pay saboteurs, drone incursions, espionage agents, and sabotage operations targeting Poland and other EU countries. Classified as defense because Poland is introducing legal crypto regulations and expelling diplomats to counter these threats, indicating active defense preparations.

Source URL

https://archive.is/Ek6eu

Open source

Provenance

Publisher: extension
Submitted: Feb 14, 2026, 12:22 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Mar 18, 2024, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "222c7711-44fa-4f19-94cc-94a7a4f8bbf3",
  "url": "https://archive.is/Ek6eu",
  "source": "extension",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "Poland",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "Poland",
    "hybrid warfare",
    "cryptocurrency funding",
    "drone incursions",
    "GRU",
    "shadow fleet",
    "espionage",
    "sabotage",
    "cyberwarfare",
    "NATO",
    "Baltic Sea",
    "intelligence",
    "terrorism plot",
    "regulation"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "According to Sławomir Cenckiewicz, chief of Poland's National Security Bureau, Russia employs cryptocurrencies to pay saboteurs and finance a network of agents recruited by its GRU military intelligence for hybrid attacks on EU countries. These operations include drone incursions violating Polish airspace, drone reconnaissance launched from Russia's shadow fleet of old oil tankers in the Baltic Sea, sabotage attempts on critical infrastructure such as water supplies, and hacking activities. At least 19 Russian drones entered Polish airspace recently, causing NATO jets to intercept some. Similar drone incidents have caused airport closures in Denmark and Germany. Poland has charged dozens of individuals with spying and sabotage linked to Russia; for example, a Ukrainian citizen accused of smuggling explosives disguised as canned food likely for drone-delivered attacks. Poland has passed legislation to tighten cryptocurrency controls aiming to cut these funding channels. Several Russian and Belarusian diplomats accused of facilitating sabotage were expelled, with Moscow increasingly using local agents. Polish officials state the cyber domain amounts to a state of war with Russia. The disclosures highlight ongoing covert hybrid warfare tactics by Russia targeting European security and infrastructure.",
  "summary_short": "Polish security chief reports Russia uses cryptocurrencies to pay saboteurs and agents for hybrid attacks on EU countries including drone incursions and sabotage.",
  "summary_extended": "Poland's National Security Bureau head Sławomir Cenckiewicz revealed that Russia is using cryptocurrencies to finance saboteurs and a network of agents involved in hybrid attacks against EU countries. These attacks have included drone incursions into European airspace, sabotage attempts targeting critical infrastructure like water supplies, and hacking operations. Evidence shared with Western intelligence highlights Russia employing its shadow fleet of old oil tankers for drone reconnaissance missions over Poland, Denmark, Germany, and Norway. Recent confrontations include at least 19 Russian drones violating Polish airspace, forcing NATO jets to shoot some down, and drone-induced airport closures in multiple countries. Poland has charged numerous individuals with spying or sabotage linked to Russian GRU intelligence, including a recent arrest of a Ukrainian citizen suspected of smuggling explosives hidden in canned food intended as drone bombs. Legislative efforts are underway in Poland to tighten cryptocurrency regulations in part to disrupt Russian funding channels. Warsaw has also expelled multiple Russian and Belarusian diplomats accused of aiding sabotage plots, with growing reliance noted on ad hoc local agents. The hybrid war extends to the cyber domain, with Poland regarded as being in a state of war with Russia. The broader context involves geopolitical tensions within Poland’s political leadership regarding NATO and EU military alliances.",
  "actor_primary": "Russia’s GRU military intelligence",
  "target_primary": null,
  "location_text": "Poland",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "Classified as aggressor because the article details Russian use of cryptocurrencies to pay saboteurs, drone incursions, espionage agents, and sabotage operations targeting Poland and other EU countries. Classified as defense because Poland is introducing legal crypto regulations and expelling diplomats to counter these threats, indicating active defense preparations.",
  "event_time_utc": "2024-03-18T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-14T12:22:49.136Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Unknown

Source reliability

Info credibility

Event time

Mar 18, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Poland

Primary actor

Russia’s GRU military intelligence

Country

Poland

Tags

Russia, Poland, hybrid warfare, cryptocurrency funding, drone incursions, GRU, shadow fleet, espionage, sabotage, cyberwarfare, NATO, Baltic Sea, intelligence, terrorism plot, regulation

Nodes

Node 1: Borders, Node 2: 5th Column

Loading signal...

{ "id": "222c7711-44fa-4f19-94cc-94a7a4f8bbf3", "url": "https://archive.is/Ek6eu", "source": "extension", "status": "approved", "category": "Intelligence & Espionage", "subcategory": "Human Intelligence (HUMINT)", "incident_type": "Recruitment of locals", "country": "Poland", "source_reliability": "B", "info_credibility": "3", "tags": [ "Russia", "Poland", "hybrid warfare", "cryptocurrency funding", "drone incursions", "GRU", "shadow fleet", "espionage", "sabotage", "cyberwarfare", "NATO", "Baltic Sea", "intelligence", "terrorism plot", "regulation" ], "nodes": [ "Node 1: Borders", "Node 2: 5th Column" ], "countries": [], "where_text": "Land", "headline": null, "description": "According to Sławomir Cenckiewicz, chief of Poland's National Security Bureau, Russia employs cryptocurrencies to pay saboteurs and finance a network of agents recruited by its GRU military intelligence for hybrid attacks on EU countries. These operations include drone incursions violating Polish airspace, drone reconnaissance launched from Russia's shadow fleet of old oil tankers in the Baltic Sea, sabotage attempts on critical infrastructure such as water supplies, and hacking activities. At least 19 Russian drones entered Polish airspace recently, causing NATO jets to intercept some. Similar drone incidents have caused airport closures in Denmark and Germany. Poland has charged dozens of individuals with spying and sabotage linked to Russia; for example, a Ukrainian citizen accused of smuggling explosives disguised as canned food likely for drone-delivered attacks. Poland has passed legislation to tighten cryptocurrency controls aiming to cut these funding channels. Several Russian and Belarusian diplomats accused of facilitating sabotage were expelled, with Moscow increasingly using local agents. Polish officials state the cyber domain amounts to a state of war with Russia. The disclosures highlight ongoing covert hybrid warfare tactics by Russia targeting European security and infrastructure.", "summary_short": "Polish security chief reports Russia uses cryptocurrencies to pay saboteurs and agents for hybrid attacks on EU countries including drone incursions and sabotage.", "summary_extended": "Poland's National Security Bureau head Sławomir Cenckiewicz revealed that Russia is using cryptocurrencies to finance saboteurs and a network of agents involved in hybrid attacks against EU countries. These attacks have included drone incursions into European airspace, sabotage attempts targeting critical infrastructure like water supplies, and hacking operations. Evidence shared with Western intelligence highlights Russia employing its shadow fleet of old oil tankers for drone reconnaissance missions over Poland, Denmark, Germany, and Norway. Recent confrontations include at least 19 Russian drones violating Polish airspace, forcing NATO jets to shoot some down, and drone-induced airport closures in multiple countries. Poland has charged numerous individuals with spying or sabotage linked to Russian GRU intelligence, including a recent arrest of a Ukrainian citizen suspected of smuggling explosives hidden in canned food intended as drone bombs. Legislative efforts are underway in Poland to tighten cryptocurrency regulations in part to disrupt Russian funding channels. Warsaw has also expelled multiple Russian and Belarusian diplomats accused of aiding sabotage plots, with growing reliance noted on ad hoc local agents. The hybrid war extends to the cyber domain, with Poland regarded as being in a state of war with Russia. The broader context involves geopolitical tensions within Poland’s political leadership regarding NATO and EU military alliances.", "actor_primary": "Russia’s GRU military intelligence", "target_primary": null, "location_text": "Poland", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "Classified as aggressor because the article details Russian use of cryptocurrencies to pay saboteurs, drone incursions, espionage agents, and sabotage operations targeting Poland and other EU countries. Classified as defense because Poland is introducing legal crypto regulations and expelling diplomats to counter these threats, indicating active defense preparations.", "event_time_utc": "2024-03-18T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-02-14T12:22:49.136Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }