Evidence gathered by German investigators has raised the possibility that Russia planned the Nord Stream explosions while seeking to create a false Ukrainian trail. The findings also point to the vulnerability of European commercial networks to covert operations linked to the Kremlin.
Reports published on 29 August 2026 said Danish naval forces recorded Russian warships and miniature submarines close to the site of the blasts in the Baltic Sea shortly before Nord Stream 1 and 2 were sabotaged in September 2022. The details were reported by German journalists, including Frankfurter Allgemeine Zeitung and summarised by 24 Kanal.
The information does not, by itself, amount to a final judicial finding that Moscow ordered the attack. But taken together with other details uncovered by the investigation, it does not exclude a carefully planned Russian “false flag” operation intended to shift blame on to Ukraine. The suspected use of a small sailing yacht, the Andromeda, and the appearance of a Ukrainian flag on board have become central to that possibility.
Evidence pointing beyond an amateur operation
German reporting has drawn attention to what it describes as unusual behaviour by the yacht’s crew and a series of suspicious “mistakes” that may have been deliberate. The company that hired the Andromeda was reportedly linked to pro-Russian activity, while the Ukrainian flag and other apparently incriminating details could have been planted to create a ready-made explanation for the explosions.
That pattern fits the established method of a false-flag operation: manufacturing a trail that implicates an adversary while concealing the organiser. For the Kremlin, the purpose would have extended beyond avoiding suspicion. A staged Ukrainian connection could have damaged confidence in Kyiv among western governments and publics at a critical stage of Russia’s full-scale invasion of Ukraine.
The presence of Russian naval vessels and mini-submarines near the pipelines shortly before the blasts is significant because it challenges the picture of an improvised group of civilian divers. Russian military and naval deep-sea platforms possess the technical capacity for operations at depth in the Baltic Sea. Their reported presence suggests a level of preparation and capability consistent with a professional military operation rather than an isolated act by amateurs.
A case before the Hamburg court
The revelations come as the Higher Regional Court in Hamburg examines the case of Serhii Kuznetsov, a Ukrainian citizen arrested in Italy in 2025. Germany’s federal prosecutor accuses him of involvement in organising the explosions, although the proceedings have not established that he has admitted responsibility.
Kuznetsov’s lawyer is seeking to have the case dismissed before hearings begin. The defence argues that, even if his client took part in the sabotage, the act would not constitute a crime under international law because the pipelines were no longer purely commercial or civilian infrastructure in September 2022. Instead, it argues, they had been integrated into Russia’s war machine and used as a weapon.
The defence also points to Gazprom’s role beyond supplying revenue to the Russian federal budget. It says the energy corporation was a direct participant in the aggression, noting that Gazprom created the Potok and Fakel private military companies. Their fighters have taken part in combat against Ukraine, a role reflected in European Union sanctions decisions.
Infrastructure as pressure and deception
If Russia destroyed its own pipelines, the operation could have been regarded in Moscow as an acceptable cost for creating panic in Europe’s energy market and increasing political tensions inside Germany. The damage might also have strengthened Russia’s argument that force majeure prevented it from meeting gas contracts with European counterparties.
That scenario would demonstrate the Kremlin’s willingness to use even infrastructure connected to its own strategic interests as an instrument of political and energy pressure. The Andromeda’s alleged links, meanwhile, expose a different vulnerability: European companies can provide logistics, finance or cover for hostile operations when their ownership and connections are not adequately scrutinised.
Immediately after the blasts, Russian authorities mounted an information campaign blaming the US, the West and Ukraine, demanding Russian participation in the investigation and promoting claims of “international terrorism”. The effect was to flood the debate with competing accusations and alternative versions of events. Such tactics seek not only to divert suspicion from Moscow but also to weaken public confidence in European institutions and collective security.
The investigation’s next decisive test will be whether the reported naval evidence, the Andromeda trail and the court proceedings can be connected into proof that would withstand judicial scrutiny. Until then, the case remains a warning that the boundary between commercial infrastructure and hybrid warfare in Europe is increasingly difficult to defend.
How should European states protect commercial systems from covert operations without paralysing legitimate business?
