Germany identifies two suspects in Leipzig airport drone attack, blames Russia
German investigators have named a Belarusian citizen and a Russian linked to Russian military intelligence (GRU) as the main suspects in the 4 August drone attack on Leipzig/Halle Airport. A drone carrying explosives hidden in a vegetable tin can landed next to a Ukrainian Antonov cargo aircraft but failed to detonate because of a faulty detonator. On 1 September, Germany officially blamed Russia for the incident and announced the closure of the Russian consulate general in Bonn and the termination of the agreement on the "Russian House" in Berlin; Moscow responded by closing the German consulate general in St. Petersburg and Goethe cultural centers.
Key points
- Attack occurred on the evening of 4 August at Leipzig/Halle Airport; a drone with explosives was discovered next to a Ukrainian Antonov aircraft overnight into 5 August.
- Two main suspects identified: Belarusian citizen Andrii Ka. and Russian citizen Oleg Le., who investigators link to Russia's GRU.
- Oleg Le. entered Germany via Turkey through Berlin-Brandenburg Airport, later flew to Serbia, and is currently in Russia; German authorities knew of his possible GRU connection at entry but did not surveil him.
- Three drones were planned; two were destroyed during takeoff for unknown reasons, the third reached the Antonov but did not detonate due to a faulty detonator.
- Approximately 1.8 kg of Semtex was planned; the explosives were brought in via Bulgaria and Serbia, stored in underground caches near the airport.
- DNA from a glove found on the drone's antenna structure identified Andrii Ka., whose DNA had been registered in Finland and Lithuania in criminal cases; Polish authorities link him to a 2024 arson in Łódź classified as sabotage with a Russian trace.
- On 1 September Germany officially blamed Russia; it closed the Russian consulate general in Bonn and the "Russian House" in Berlin, and on 7 September Moscow announced the closure of the German consulate general in St. Petersburg and Goethe centers.
Why it matters
Germany has officially accused Russia of an attempted terrorist act on German soil, an unprecedented step linking the GRU to sabotage on German territory. The target was a Ukrainian Antonov aircraft — the first publicly identified case of a suspected Russian sabotage operation aimed at Ukrainian military-logistics assets hosted by a NATO member state. Berlin's response, closing Russian consular facilities, signals a sharp escalation in Germany–Russia tensions, while the multi-country logistics trail through Bulgaria, Serbia, Turkey, Finland, Lithuania and Poland underscores the transnational scope of suspected Russian hybrid operations in Europe. The device failed only because of a faulty detonator beside a fuel-laden aircraft, indicating a far more destructive outcome was intended.
What happened
On the evening of 4 August, a drone carrying approximately 1.8 kg of Semtex hidden in a vegetable tin can landed next to a Ukrainian Antonov An-124 cargo aircraft at Leipzig/Halle Airport but failed to detonate because of a faulty detonator. Two other drones intended for the attack were destroyed during takeoff for reasons that remain unknown. Investigators later identified two main suspects: Andrii Ka., a Belarusian citizen whose DNA was recovered from a glove fragment on the antenna structure used to control the drone and whose DNA had been registered in Finland and Lithuania in prior criminal cases, and Oleg Le., a Russian citizen believed to be linked to Russia's GRU, who handled the operation's planning and logistics. Le. entered Germany via Turkey through Berlin-Brandenburg Airport, later flew to Serbia, and is currently in Russia; German authorities knew of his possible GRU affiliation at the time of his entry but did not surveil him afterwards. The explosives are believed to have been smuggled into Germany via Bulgaria and Serbia, stored in underground caches near the airport that police located by analyzing data from a rental car used by one of the suspects. Polish authorities link Ka. to the 2024 arson of a construction store in Łódź, which Polish prosecutors classify as sabotage with a Russian trace. On 1 September the German government officially blamed Russia for the incident and announced the closure of the Russian consulate general in Bonn and the termination of the agreement on the "Russian House" in Berlin; on 7 September Moscow announced the closure of the German consulate general in St. Petersburg and Goethe cultural centers in retaliation. Earlier the same night as the drone incident, a cargo aircraft unable to land due to the airport shutdown collided with another object at several hundred meters altitude.
How Ukrainian sources describe it
Ukrainian media frame the Leipzig incident as a suspected Russian hybrid attack on Ukrainian Antonov logistics assets hosted in Germany, foregrounding the GRU link to one suspect and the failure of German security services to monitor him despite prior knowledge of his intelligence affiliation. They stress the transnational European dimension — the routing of explosives through Bulgaria and Serbia and the Polish sabotage link — as part of a broader pattern of Russian sabotage and hybrid operations across the continent. The Ukrainian Foreign Ministry reported no casualties and no damage to Antonov aircraft from the incident.
Where reporting differs
Sources differ on whether the targeted Ukrainian An-124 was carrying ammunition delivered from France: WDR, NDR and Süddeutsche Zeitung cited a confidential police report saying it was, while German authorities officially stated there were no munitions on board. Early Süddeutsche Zeitung reporting on 2 September described one suspect as Russian-born with a Latvian passport and the other as Belarusian-born with a Russian passport, while later Welt reporting identified them as a Belarusian citizen and a Russian citizen. Most sources attribute the device's failure to a detonator malfunction, though one source also notes the detonator may have broken off. Russia, through Putin, denied involvement and tied the accusations to Chancellor Merz's domestic political difficulties, while German and Ukrainian sources point to evidence of GRU involvement.
Background
Leipzig/Halle Airport has hosted Ukrainian Antonov aircraft since 2022. Oleg Le.'s possible GRU affiliation was known to German law enforcement at the time of his entry to Germany, but no surveillance was established after his arrival. Andrii Ka. has prior links to a theft case in Finland and to the 2024 arson of a construction store in Łódź, Poland, which Polish prosecutors classify as sabotage with a Russian trace. A Federal Criminal Police Office report cited by Süddeutsche Zeitung records more than 165 suspected sabotage cases and hundreds of suspicious-drone incidents in Germany since the start of 2026, against a backdrop of growing sabotage, arson and cyberattacks across Europe with Russia suspected in several cases.