Poland charges two Ukrainians with spying and sabotage for Russia
Arrested on 3 November and charged the next day, the two men are accused of scouting military sites and torching cars to turn Poles against Ukrainians; the latest case in a shadow war Warsaw says Moscow has waged since 2022.
Published 10 November 2026 · 12:07 GMT
The summary
Poland's Internal Security Agency (ABW) said on Tuesday 10 November that it had arrested two Ukrainian men suspected of espionage and sabotage on behalf of Russian intelligence services. Poland's National Prosecutor's Office said the men were arrested on 3 November and charged on 4 November; the case was announced on 10 November.
The three lenses
- WestThe West reads another front in the shadow war Western coverage, led by the Reuters wire that most outlets carried, treats the arrests as the latest episode in the hybrid campaign Poland has described since 2022.
- EastAsia reports the mechanics and keeps Moscow's denial in frame Coverage in Asia has carried the same facts with a different centre of gravity.
- Global SouthThe Global South sees refugees turned into a weapon Coverage in the Global South, led by Al Arabiya's carrying of the wire, reads the case through the people caught in it.
Key facts
- Poland's Internal Security Agency (ABW) said on Tuesday 10 November that it had arrested two Ukrainian men suspected of espionage and sabotage on behalf of Russian intelligence services. Reuters
- Poland's National Prosecutor's Office said the men were arrested on 3 November and charged on 4 November; the case was announced on 10 November. EconoTimes
- According to the ABW, the men reconnoitred critical infrastructure and military facilities across Poland on behalf of Russian special services. The Hindu
- Investigators say the men set fire to vehicles after fitting them with licence plates resembling those used by the Ukrainian military, and were paid including in cryptocurrencies. The Hindu
- Prosecutors said the sabotage was carried out at the behest of Russian intelligence services and was intended to fuel anti-Ukrainian sentiment. Reuters
- Both men face between ten years in prison and life imprisonment if found guilty. Al Arabiya
- In a separate case, the ABW said six people were detained over alleged transfers of military components to Russia, with four facing espionage charges. EconoTimes
Two arrests, announced a week after they happened
Poland's Internal Security Agency, the ABW, has arrested two Ukrainian men suspected of espionage and sabotage carried out on behalf of Russian intelligence services, the agency said on Tuesday 10 November. The announcement came a week after the arrests themselves: according to Poland's National Prosecutor's Office, the men were detained on 3 November and formally charged the following day.
The charges are grave. Prosecutors say both men engaged in espionage for a foreign intelligence service against Poland and committed acts of sabotage. If convicted, each faces between ten years in prison and life imprisonment. The ABW said the men reconnoitred critical infrastructure and military facilities across the country for Russian special services, and set fire to vehicles after swapping their plates for ones resembling Ukrainian military plates. They were paid for the work, investigators said, including in cryptocurrencies.
Prosecutors were explicit about the purpose. In a separate statement, they said the investigation had established that the sabotage was carried out at the behest of Russian intelligence services and was intended to fuel anti-Ukrainian sentiment in Poland. The Russian embassy in Warsaw did not immediately respond to a request for comment.
The dates, the charges, and the method prosecutors describe
The timeline is now documented from two directions. The ABW announced the case on 10 November, and the National Prosecutor's Office confirmed that the arrests took place on 3 November and the charges were filed on 4 November. The charge sheet, as quoted by the prosecutor, covers espionage on behalf of a foreign intelligence service against Poland as well as acts of sabotage, and the penalty range runs from ten years to life imprisonment.
The method, as investigators describe it, had two parts. The first was reconnaissance: the men are accused of surveying critical infrastructure and military facilities across Poland for their handlers. The second was arson with a signature: vehicles were set on fire after their plates were replaced with ones resembling Ukrainian military plates, so that the crime would read, to anyone who saw it, as the work of Ukrainians. Payment followed, at least in part in cryptocurrency.
The case does not stand alone. In a separate matter, the ABW said six people had been detained over alleged transfers of military components to Russia, four of them facing espionage charges, and the pattern has a precedent in the November 2025 railway sabotage case on the Warsaw–Lublin line. The ABW announcement adds to a crowded Polish security agenda that has also included a deadly shooting in Krakow.
What is still unknown about the two men and their handlers?
Almost everything that would let the public judge the scale of the case is still undisclosed. The names and ages of the two men have not been released, and neither has any detail about where in Poland they were arrested or where they had been living. The ABW has not said which infrastructure or military sites were scouted, how many vehicles were set on fire, or over what period the tasks were carried out.
The money is equally opaque. Investigators say the men were paid, including in cryptocurrencies, but no sums have been published, and no wallets, intermediaries or handlers have been named. Nothing has been said about how the men were recruited, who gave them their orders, or whether they knew each other before the operation began.
Nor is it clear whether the network ends with them. The ABW has not said whether further arrests are expected, whether the six-person case is connected, or when the men will stand trial. Until prosecutors put evidence before a court, the most important questions about scale remain open.
A frontline state, and a tactic aimed at its guests
Poland is the hinge of the war next door. It is NATO's eastern flank, the main corridor for Western military aid into Ukraine, and the country that has absorbed the largest movement of Ukrainians fleeing the invasion. An espionage and sabotage network inside Poland is therefore not a local crime story: it touches the alliance's logistics, the aid corridor, and a society that has carried much of the war's human cost. Russian strikes on aid distribution inside Ukraine show the same pressure applied from the other side of the border, and this case suggests the pressure is being applied inside Poland as well.
The tactic matters as much as the target. Prosecutors say the arson was designed to be blamed on Ukrainians, which makes the operation a piece of political engineering as much as sabotage: the crime was meant to be seen, misattributed, and then to do its work in Polish opinion. If the allegation holds, the operation used two Ukrainians to turn Poles against Ukrainians, converting the presence of refugees into a vulnerability to be exploited.
That is why the case will be watched beyond Warsaw. Poland has accused Russia and Belarus of a hybrid campaign since the 2022 invasion, and Moscow has repeatedly denied it; each new case will be judged on what prosecutors can prove in court.
Why would Moscow pay Ukrainians to burn cars in Poland?
The operation described by Polish prosecutors follows a logic that has become familiar across Europe: low cost, high deniability, and a target chosen for its political effect rather than its military value. Reconnaissance of infrastructure and military sites is the espionage; the arson is the message. Burning a car achieves little alone, but a car burned under a Ukrainian military plate plants a story that travels faster than any investigation.
The choice of operatives is the point. Recruiting Ukrainians to commit the crimes removes the most obvious fingerprints and, if the prosecutors are right, turns the victims of the war into its instruments. Cryptocurrency payments complete the design: money without a bank, handlers who never meet their recruits, and a chain hard to prove in court. The warnings from Warsaw about Russia now come with case files attached.
Moscow's strategy is not only pressure on NATO's flank; it is also the deepening of partnerships elsewhere, as shown by the rocket-launcher deal that illustrates deepening Russian ties. The Polish case is a small piece of that design, but its method, if proven, is the design in miniature.
Pressure on Polish-Ukrainian trust, and on the next investigation
The first consequence is domestic. Anti-Ukrainian sentiment is already a live current in Polish politics, and a case in which Ukrainians are accused of torching cars for Russian handlers will feed it, whatever the eventual verdict. The risk is not only electoral: it is the daily texture of life for Ukrainians living in Poland, who may find suspicion hardening around them because of crimes they had nothing to do with. Warsaw and Kyiv both have an interest in containing that damage, and both will be judged on how they speak about the case.
The second consequence is institutional. A conviction carrying ten years to life would be a deterrent, but only if the evidence survives a courtroom; an acquittal, or a trial that drags without disclosure, would hand Moscow a talking point and feed scepticism about the hybrid-war narrative itself. The ABW's credibility is therefore on trial alongside the two men, and its next announcements, including on the separate six-person case, will be read as a test of whether the network is wider than two recruits.
The third is strategic. NATO's eastern members have spent four years adapting to sabotage and disinformation as a permanent condition, and each case sharpens the question of response: how does an alliance answer operations designed to stay below the threshold of war?
What happens next for the two men?
The immediate next step is the courtroom. No trial date has been announced, and the first test of the case will be whether prosecutors disclose the identities of the two men, the facilities they are accused of scouting, and the evidence behind the payments. Until then, the public record consists of two official statements, and the gap between accusation and proof is the space in which the story will be fought.
The second question is scope. The ABW has not said whether more arrests are coming, whether the six detained over component transfers are connected, or whether recruitment reaches beyond the two men.
The third is the response from Moscow. The Russian embassy in Warsaw has not commented, and a formal denial, if it comes, will follow the pattern of every previous Polish allegation. Beyond the rhetoric, the measure that matters is whether the operations continue: further arson, further recruitment, or a pause while the network is rebuilt. The case is closed as an arrest; as a campaign, it is still open, and the next ABW statement will say more about its scale than this one did.
The three lenses
West Lens:
The West reads another front in the shadow war Western coverage, led by the Reuters wire that most outlets carried, treats the arrests as the latest episode in the hybrid campaign Poland has described since 2022. The emphasis falls on the geography: a frontline NATO state and the aid corridor into Ukraine. The 2025 railway case is cited as the pattern's previous chapter.
East Lens:
Asia reports the mechanics and keeps Moscow's denial in frame Coverage in Asia has carried the same facts with a different centre of gravity. The Hindu and The Straits Times both foreground the mechanics: the dates, the charges, the reconnaissance of infrastructure and military sites, the swapped plates, the cryptocurrency payments and the ten-years-to-life penalty. Russia's repeated denials are carried prominently, and the story is framed as one more data point in the Russia–West confrontation.
South Lens:
The Global South sees refugees turned into a weapon Coverage in the Global South, led by Al Arabiya's carrying of the wire, reads the case through the people caught in it. The striking fact, from this angle, is not the espionage but the instrument: displaced Ukrainians, recruited to commit crimes designed to be blamed on Ukrainians, in a country sheltering large numbers of their compatriots. The lens here is the spillover of a European war into third countries and third lives, and the question of who benefits when a host society turns against the refugees it took in.
The consensus
- What we agree on
- What we agree on: Poland's Internal Security Agency arrested two Ukrainian men on 3 November and charged them on 4 November with espionage for a foreign intelligence service and acts of sabotage; the ABW says they scouted critical infrastructure and military sites, set fire to vehicles fitted with plates resembling Ukrainian military ones, and were paid including in cryptocurrency; prosecutors say the acts were ordered by Russian intelligence to fuel anti-Ukrainian sentiment; and each man faces ten years to life if convicted.
- What we don't agree on
- What we disagree on: whether the arrests prove a centrally directed Russian campaign or the opportunistic recruitment of two men; whether the sabotage meaningfully shifted Polish opinion about Ukrainians; how far the hybrid campaign against Poland extends beyond the cases announced so far; and whether the heavy sentences the men face will deter further recruitment or simply push it further underground.
- What we know
- What we know: the dates of the arrests and charges, the charges themselves, the methods prosecutors describe, the cryptocurrency payments, the separate detention of six people over alleged military-component transfers to Russia, and the 2025 precedent of a Ukrainian charged over railway sabotage on the Warsaw–Lublin line.
- What we don't know yet
- What we do not know: the men's identities, which facilities they scouted, how many vehicles were set alight, how much they were paid, how they were recruited and by whom, whether they acted alone or inside a wider network, and when their trial will begin.
- What we expect
- What we expect: prosecutors to release further details as the case moves toward trial; the Russian embassy's silence to be replaced by a formal denial; further ABW announcements if the network proves wider; and the case to feature in Poland's debate over the security of its eastern flank and its Ukrainian community.
Questions, answered
Who was arrested in Poland, and what are they accused of?
Two Ukrainian men were arrested by Poland's Internal Security Agency, the ABW, on suspicion of espionage and sabotage on behalf of Russian intelligence services. Prosecutors say they scouted critical infrastructure and military facilities across Poland, set fire to vehicles fitted with plates resembling Ukrainian military ones, and were paid for the work, including in cryptocurrencies.
When were the men arrested and charged?
The men were arrested on 3 November and formally charged on 4 November, according to Poland's National Prosecutor's Office. The case was only announced publicly on Tuesday 10 November, a week after the arrests, when the ABW issued its statement and prosecutors confirmed the charges and the alleged motive.
What were the men allegedly trying to achieve?
Prosecutors say the sabotage was carried out at the behest of Russian intelligence services and was intended to fuel anti-Ukrainian sentiment in Poland. The vehicle fires were designed to be blamed on Ukrainians, because the cars carried plates resembling those used by the Ukrainian military, turning a criminal act into a political message.
What punishment do the men face, and what happens next?
Each man faces between ten years in prison and life imprisonment if found guilty of espionage for a foreign intelligence service and acts of sabotage. No trial date has been announced. Prosecutors are expected to disclose further details as the case moves toward court, and the ABW has not said whether further arrests will follow.
Sources
- Reuters (10 Nov 2026); the primary wire report: the arrests, the ABW statement, the charges and the prosecutors' account of the motive
- EconoTimes (10 Nov 2026); the prosecutor's timeline: arrested 3 November, charged 4 November, announced 10 November, plus the separate six-person case
- The Hindu (10 Nov 2026); the wire account carried in India: the reconnaissance, the vehicle fires, the cryptocurrency payments and the penalty
- Al Arabiya (10 Nov 2026); the wire account carried in Saudi Arabia: the ABW findings, the charges and the intended effect on public sentiment