Russia pays Europe’s saboteurs in crypto, says Polish official

Russia has used cryptocurrencies to pay saboteurs involved in its hybrid attacks on EU countries, in an attempt to prevent intelligence services from tracking the payments, according to a senior Polish security official.

Poland’s national security bureau chief Sławomir Cenckiewicz told the Financial Times that Moscow was probably using this payment method to fund attacks, which have recently ranged from drone incursions to sabotage and attempts to hack water supplies and other critical infrastructure. He also said evidence shared with western intelligence services showed Russia was using its shadow fleet to launch drones into European airspace.

Last month, at least 19 Russian drones violated Poland’s airspace, forcing Nato jets to shoot some of them down in the first direct confrontation between the alliance and the Kremlin’s assets since Moscow’s full-scale invasion of Ukraine in 2022. Drones have recently also forced airport closures in Denmark, Germany and elsewhere, with Nato holding talks on allowing a more forceful response to the Kremlin’s provocations.

Ukraine’s President Volodymyr Zelenskyy has accused Russia of using its shadow fleet in the Baltic Sea to launch drones on European countries. Cenckiewicz said similar evidence had been shared among the intelligence services of Poland, Denmark, Germany and Norway.

“They confirm that the shadow fleet of often very old Russian oil tankers that used to smuggle oil is being used by Russia for [drone] reconnaissance,” he said.

A network of agents recruited by Russia’s GRU military intelligence agency and uncovered in Poland in 2023 had “to a high extent been financed with cryptocurrency”, he said, a payment method that Warsaw believes Moscow is continuing to use to this day.

Lawmakers in Poland’s lower house last month approved a bill to tighten regulation of the crypto asset market, including prison sentences for those who fail to comply with oversight rules. Cenckiewicz said the bill should also be viewed as a tool to curb Russian funding channels.

“The Polish intelligences services are very much interested in this whole legislative process, to ensure there are no gaps that would allow foreign powers to use [crypto] to finance their agents,” he said.

The Kremlin has successfully used crypto tokens, exchanges and networks to circumvent western sanctions and maintain its financial flows after Russian lenders were cut off from the US-led Swift payment system in the wake of Moscow’s full-scale invasion of Ukraine.

Over the past three years, Poland has charged dozens of individuals with spying or sabotage and accused Russia of orchestrating arson attacks and other incidents, including a recent hacking attempt to cut off the water supplies of a major Polish city.

“When we look at the cyber domain, Poland is now in a state of war [with Russia], it’s not a state of threat any more,” Cenckiewicz said.

On Monday, a Russian couple was charged with spying after being detained in Poland last year for allegedly informing Russian intelligence about Kremlin opponents.

Polish prosecutors have also opened an investigation into a Ukrainian citizen suspected of working for the GRU and smuggling explosives into Poland from Lithuania, hidden in food cans labelled as corn. Cenckiewicz said it was “probably a planned terrorist operation”, in which the cans could have been mounted on drones and dropped as bombs.

Polish prosecutors this month launched a separate probe after a coal wagon was found detached from its train on a busy line in Katowice. Cenckiewicz described the incident as “one of the other elements in the playbook of Russian diversion activities”.

Over the past year, Warsaw has closed two Russian consulates and expelled several Russian and Belarusian diplomats accused of aiding sabotage plots.

Cenckiewicz said such diplomats were only “the first layer” of infiltration, with Moscow increasingly relying on “ad hoc” local agents for specific missions. These operatives, he said, could be paid small sums and presented “a low risk for them in terms of recruitment”.

Warsaw last week handed over to Kyiv a 16-year-old Ukrainian who is accused of helping Russian intelligence services recruit other Ukrainian youngsters to carry out attacks. While the vast majority of Ukrainians who arrived in Poland after 2022 were “legitimate refugees”, Cenckiewicz said “there is no doubt that the Russians had some assets among these people”.

Cenckiewicz is a vital appointee of rightwing President Karol Nawrocki, who got backing from the Maga movement and is at odds with the government of pro-EU Prime Minister Donald Tusk. Cenckiewicz is facing a criminal probe for allegedly leaking secrets to undermine Tusk’s bid for the premiership. He denies wrongdoing and says his legal battle and domestic political tensions do not undermine national security.

As a “European politician” Tusk “believes that besides Nato, the European Union can in the future have its own military alliance and in this situation Nato would play an auxiliary role . . . or even later cease to exist”, Cenckiewicz argued. “We think differently: we are Atlanticists, we are pro-American and we think the only military alliance that is beneficial for Poland is and will be Nato.”