The Whole Thing in 5 Lines
Before the details — what is actually known:
- On 26 September 2022, four explosions struck the Nord Stream 1 and Nord Stream 2 pipelines in the Baltic Sea, near the Danish island of Bornholm. Three of four pipeline strings were destroyed.
- Seismologists in Sweden and Denmark recorded the blasts independently and confirmed they were consistent with several hundred kilograms of high explosives — not accidents, not gas leaks. Sabotage was established almost immediately.
- Sweden and Denmark closed their investigations in February 2024 without naming a perpetrator, citing lack of jurisdiction or insufficient evidence to prosecute. Germany's investigation continued.
- In August and September 2025, Italian and Polish police arrested two Ukrainian nationals on German arrest warrants connected to the operation, allegedly involving a yacht called Andromeda. A Polish court denied Germany's extradition request for one suspect in October 2025.
- No government has formally and publicly attributed state responsibility. Theories implicate Russia, Ukraine (potentially without government-level authorisation), and — in some assessments — actors with interest in disrupting Russia-Germany energy ties. All are assessed below with their actual evidential support.
The Mystery
What Exactly Happened
The Nord Stream pipeline system was, before September 2022, the largest direct gas transport link between Russia and Western Europe. Nord Stream 1 had been operational since 2011, carrying Russian natural gas under the Baltic Sea directly to Germany, bypassing Poland, Belarus, and Ukraine entirely. Nord Stream 2, a parallel system completed in 2021, had never become operational — Germany suspended its certification days before the invasion of Ukraine in February 2022, and the pipeline sat full of gas but unused.
In the early hours of 26 September 2022, instruments at seismological stations across northern Europe recorded two distinct sets of underwater explosions — one at approximately 02:03 CEST and another at approximately 19:04 CEST the same day, separated by roughly 17 hours and around 50 nautical miles. Within days, large surface disturbances — methane bubbling to the surface across areas up to a kilometre wide — were visible from aircraft and satellites near the Danish island of Bornholm.
"What makes this case different from most unsolved mysteries is not the absence of evidence. It is the presence of an enormous amount of evidence — seismic data, satellite imagery, vessel tracking, forensic traces — that has been collected by multiple sovereign governments, and which has still not produced a single public conviction or formal state attribution three years later."
Three of the four pipeline strings were destroyed: both lines of Nord Stream 1, and one line of Nord Stream 2. The fourth line — Nord Stream 2's B pipe — remained intact and undamaged, a detail that has fuelled theories on every side of the debate, since it represents either an opportunity missed by the saboteurs or a deliberate choice to leave a line operational.
The pipelines lie in international waters and within the exclusive economic zones of Denmark and Sweden, at depths of 70–90 metres — shallow enough for trained divers using rebreathing equipment to operate, but requiring significant logistical support, including a vessel capable of transporting and deploying explosive charges without detection in one of the most heavily monitored maritime regions in the world.
Discovery
How the World Found Out
The Seismic Signal
The first hard evidence came not from the pipeline operators but from earthquake monitoring networks. The Swedish National Seismic Network (SNSN) and Danish equivalents recorded clear, non-natural seismic events at the times and locations later confirmed as the blast sites. Seismologist Björn Lund stated publicly within a day that there was "no doubt" the events were explosions, not earthquakes — the waveform signatures were inconsistent with tectonic activity and consistent with detonations.
The Methane Plumes
Gas began surfacing in three separate locations, visible as turbulent circles on the sea surface up to roughly a kilometre across. Danish military aircraft photographed the plumes. The volume of gas released was substantial — Nord Stream operator estimates and independent atmospheric monitoring suggested the leaks released a significant fraction of Denmark's annual greenhouse gas emissions in methane alone, making this also one of the largest single methane release events ever recorded.
The Immediate Diplomatic Reaction
Within 48 hours, Swedish police opened a "gross sabotage" investigation. NATO Secretary-General Jens Stoltenberg stated the incident was the result of "deliberate, reckless, and irresponsible acts of sabotage." The diplomatic temperature was immediate and high — this occurred seven months into Russia's full-scale invasion of Ukraine, during a period of acute European energy crisis, and the symbolism of an attack on critical Russia-Europe energy infrastructure was impossible to separate from the broader war context, regardless of who was actually responsible.
Timeline of the Investigation
26 Sep 2022
Explosions detected via seismic monitoring. Methane plumes visible at surface within hours. Sweden opens sabotage investigation.
Oct–Nov 2022
Sweden, Denmark, and Germany each open separate national investigations, citing jurisdiction over different aspects of the incident. Site access is restricted, including to Nord Stream AG itself.
Feb 2023
US journalist Seymour Hersh publishes a report, citing a single anonymous source, claiming the US Navy planted the explosives with Norwegian assistance. The US government denies involvement. The claim is not corroborated by other reporting or by any of the four national investigations.
Mar 2023
German, US, and other Western media report investigators are examining a yacht, the Andromeda, allegedly chartered by a Poland-based company and used by a small crew to transport and deploy explosives near the blast sites in September 2022.
Jul 2023
Explosive traces (HMX/octogen, a military-grade explosive) reportedly found on samples taken from the Andromeda, according to German media citing investigators.
Feb 2024
Sweden and Denmark both close their national investigations without identifying or charging anyone, citing lack of jurisdiction to prosecute (Sweden) or insufficient evidence for a viable case (Denmark). Germany's investigation continues.
Aug–Sep 2025
Italian police arrest a Ukrainian national (named in reports as Serhii K.) in San Clemente, Italy, on a German arrest warrant alleging he led the operation. Polish police arrest a second Ukrainian national, Volodymyr Zhuravlev, near Warsaw.
Oct 2025
A Polish court denies Germany's extradition request for Zhuravlev, escalating diplomatic tension between Warsaw and Berlin. Polish PM Donald Tusk publicly questions whether the sabotage was wrongful, given Nord Stream 2's role in Russian energy leverage over Europe.
What Investigators Established
The Known and the Unknown
Three years of investigation by four national governments — Sweden, Denmark, Germany, and to a lesser extent international bodies via the UN Security Council — have produced a substantial body of established fact alongside an almost equally substantial body of unresolved questions. Separating the two clearly is the first step toward understanding why this case remains open.
✓ Established as Fact
- The explosions were deliberate detonations of high-grade explosives, not accidents, equipment failure, or natural seismic events — confirmed independently by Swedish and Danish seismological data.
- The operation required placing explosive charges at depths of 70–90 metres on four separate pipeline locations, almost certainly using trained divers or remotely operated vehicles.
- A vessel — the yacht Andromeda — was used in the vicinity of the blast sites in the days before the explosions, according to German investigators, with traces of HMX explosive reportedly found aboard.
- The Andromeda was reportedly chartered using forged or borrowed identity documents, through a company with links to Poland-based individuals.
- Both Sweden and Denmark have ruled out their own armed forces' involvement and have not attributed the act to any specific government.
✗ Still Unresolved
- Whether the individuals connected to the Andromeda acted on behalf of, with the knowledge of, or independently from the Ukrainian government or military leadership.
- Whether the small crew allegedly involved had the technical capability to execute an operation of this complexity without state-level naval support — a point of significant scepticism among naval and intelligence experts.
- Why Nord Stream 2's B pipe was left undamaged — whether by deliberate choice, technical limitation, or incomplete execution of the plan.
- Whether any government had advance knowledge of the operation, including whether warnings reported by some intelligence services (Dutch, CIA) reached relevant parties before the attack.
- Germany's full investigative findings, which remain largely confidential — the public record consists almost entirely of media leaks rather than official disclosures.
⚡ Reality Check — Why Hasn't Anyone Just Said Who Did It?
The silence itself is informative — but not in a way that points cleanly at any one answer.
Three different explanations for the lack of formal attribution are all plausible simultaneously. First: the evidence may genuinely be inconclusive at the state-responsibility level, even if individual operatives have been identified — knowing who placed the charges is different from proving who ordered it. Second: governments may have reached internal conclusions they are unwilling to state publicly for diplomatic reasons — accusing Ukraine, a wartime ally for NATO members, of attacking critical infrastructure on NATO-adjacent territory creates enormous political complications regardless of the truth. Third: investigations of this sensitivity, involving intelligence services and military-grade explosives, are often deliberately kept opaque even from allied governments. All three explanations are consistent with the available public evidence. None can currently be ruled out.
Leading Theories
Who Could Have Done This, and Why
Four broad theories have circulated since 2022, each with different levels of evidential support. They are presented here in approximate order of how much support they currently have among the public investigative record — not in order of political convenience for any party.
This is the theory that the publicly known investigative trail — the Andromeda, the arrests of Ukrainian nationals, the HMX traces — most directly points toward. Multiple Western media investigations (Washington Post, Der Spiegel, Wall Street Journal, Süddeutsche Zeitung, ZDF, and the Kyiv Independent's own reporting) have separately corroborated elements of a Ukrainian-linked operation involving a small team operating from Poland. The Wall Street Journal's August 2024 reporting, citing anonymous Ukrainian military and intelligence sources, claimed the operation was conceived by senior Ukrainian military officers without President Zelensky's direct knowledge, and that Zelensky later ordered it stopped — too late.
This theory does not require believing the Ukrainian state, as a matter of official policy, ordered the attack. It is compatible with a scenario where elements within Ukraine's security or military establishment — potentially with informal political cover — conducted the operation independently.
Russia had clear motives: ending Nord Stream's relevance allowed Moscow to permanently cut gas supply to Europe (which it was already doing incrementally through 2022) while shifting blame onto the West, deepening European energy anxiety, and potentially driving a wedge between European allies over Ukraine. Russia also possesses the most sophisticated underwater naval capability of any actor with motive — including specialised deep-sea vessels reportedly tracked near the Baltic in the weeks before the attack by Danish and Swedish intelligence.
However, the operational logic is contested. Some experts, including former German intelligence chief August Hanning, have noted that destroying pipelines Russia itself built and could have simply shut off unilaterally — at zero cost and with full deniability — seems an unnecessarily complex and exposed way to achieve the same outcome. Russia's own statements have alternated between blaming the US/UK and demanding international investigation, without presenting independent evidence.
In February 2023, veteran investigative journalist Seymour Hersh published a detailed account claiming the US Navy, using a Norwegian-assisted operation under cover of a NATO exercise (BALTOPS 22), planted the explosives on President Biden's orders. The report was based on a single anonymous source and included specific operational details.
The claim must be labelled clearly: it has not been corroborated by any of the four national investigations, has not been supported by any other journalist's independent sourcing, and the US government has explicitly and repeatedly denied it. Hersh has a track record of major historical scoops (My Lai, Abu Ghraib) but also of reports that did not hold up. The claim cannot be dismissed purely on the basis of "the US denied it" — governments deny covert operations as a matter of course — but it also has not gained additional evidentiary support in the years since publication, despite the intense scrutiny the case has received. This theory remains in the public discussion primarily because of Hersh's reputation, not because of independent verification.
A less widely circulated theory holds that a state with interest in preventing renewed Russia-Germany energy cooperation after the war — potentially Poland, the Baltic states, or another actor with a long-standing strategic interest in Nord Stream's failure — could have conducted or sponsored the operation. Poland's leadership had publicly and consistently opposed Nord Stream 2 since before construction, on the grounds that it bypassed and economically weakened Poland and Ukraine while increasing German dependency on Russian gas.
This theory overlaps significantly with Theory 1, given that the arrested individuals have connections to Poland-based logistics. The distinction is about command authority: did a Polish state actor direct the operation, or did Ukrainian operatives simply use Poland as a operational base independent of Polish government involvement? Polish Prime Minister Donald Tusk's 2025 comments — questioning the framing of the attack as a crime rather than a justified act against an instrument of Russian leverage — have added a political dimension without resolving the operational question.
Evidence For and Against Each Theory
Weighing the Case
Theory 1 — Ukraine-Linked Operation
Evidence For
Multiple independent media investigations converge on the Andromeda and Ukrainian nationals. Two arrests made on this basis in 2025. HMX traces reportedly found on the vessel. WSJ sourcing describes specific operational planning by named military figures.
Evidence Against / Open Questions
Naval experts have repeatedly questioned whether a six-person civilian team on a rented yacht had the technical capability to execute deep-water demolition at this scale without state-level diving and logistics support. If true, "who actually provided that support" remains unanswered.
Theory 2 — Russian State Operation
Evidence For
Clear strategic motive. Demonstrated technical capability (Russian naval assets, including the GUGI deep-sea research fleet, were reportedly active in the Baltic in the preceding weeks per Danish/Swedish reporting). History of hybrid operations against European infrastructure.
Evidence Against / Open Questions
No physical, forensic, or signals evidence publicly linking Russian state assets to the specific blast sites has been disclosed by any of the four investigations. The "why destroy what you could simply turn off" objection remains unanswered by proponents of this theory.
Theory 3 — US/NATO Operation (Hersh)
Evidence For
The US had a clear strategic interest in Nord Stream 2 never becoming operational — a position stated publicly and repeatedly by US officials before the war. BALTOPS 22 did occur in the relevant timeframe and area.
Evidence Against / Open Questions
Single anonymous source. No corroboration from any of the journalists, outlets, or governments that have had access to the actual investigative files. No physical evidence presented. The specific operational details in the Hersh account have not been matched to any element of the Andromeda investigation.
⚡ Reality Check — What Would Falsify Each Theory?
This is where it gets genuinely hard.
For Theory 1, proof that the arrested individuals had no outside help would weaken it — but three years in, no such help has been identified either way. For Theory 2, the lack of any disclosed Russian forensic link after this much scrutiny is meaningful, though Russia's GUGI submarine fleet is built to leave no trace. For Theory 3, the total absence of corroboration is the strongest argument against it — but proving nothing exists is always hard. Two theories remain genuinely live. Two have visibly weakened since 2023.
Current Research
What Is Happening Now
The German Investigation
Germany's federal prosecutor's office (Generalbundesanwalt) continues to hold the most active formal investigation. Unlike Sweden and Denmark, Germany has pursued arrest warrants and extradition requests — indicating its prosecutors believe they have a viable case against specific individuals, even if the broader question of state direction remains open. The German approach treats this primarily as a criminal matter (sabotage of critical infrastructure) rather than as a matter requiring international state attribution.
The Poland-Germany Extradition Dispute
The October 2025 Polish court decision denying extradition has become a significant diplomatic flashpoint. Poland's reluctance reflects a genuine political tension: many in the Polish government and public view Nord Stream as an instrument that increased Russian leverage over Europe and bypassed Polish interests, making prosecution of someone who damaged it politically unpalatable domestically, regardless of the legal merits of the German case. This dispute is, in itself, now part of the story — a NATO ally refusing to extradite a suspect to another NATO ally over an attack widely (though not officially) attributed to actors connected to a third ally (Ukraine), in the context of a war against a common adversary (Russia). The diplomatic complexity has arguably become as significant as the original forensic question.
UN Security Council Involvement
Russia has repeatedly requested UN Security Council sessions on Nord Stream, using the forum to criticise the pace and transparency of Western investigations. These sessions have not produced any independent international investigative mechanism — Western Security Council members have generally argued that national investigations by Sweden, Denmark, and Germany are sufficient and that an international mechanism is unnecessary, a position Russia disputes.
Insurance and Civil Litigation
Separately from the criminal investigations, Nord Stream AG (the pipeline operator, majority-owned by Russia's Gazprom) has pursued civil litigation against insurers who declined to cover the damage, citing war-related exclusion clauses. These proceedings, while not focused on attribution, occasionally surface technical and forensic details about the damage that are relevant to the broader investigation.
What Could Solve the Mystery
What Would It Take to Actually Know?
Several specific developments would meaningfully change the state of this case, each with different probabilities of occurring.
A Conviction with Disclosed Evidence
If Germany successfully prosecutes one of the arrested individuals, the trial would necessarily involve disclosure of evidence currently held confidentially — explosive residue analysis, vessel tracking data, communications intercepts if any exist. A trial is the most realistic near-term mechanism by which currently-secret evidence could become public. The Polish extradition refusal makes this less certain for at least one suspect.
Testimony from Someone With Direct Knowledge
Operations of this complexity involve people beyond those who physically planted the charges — planners, financiers, logistics providers. A defection, whistleblower account, or plea-bargained testimony from someone in this chain would be more directly informative than forensic evidence about the blast sites themselves, which primarily proves how the attack was carried out, not who ordered it.
Declassification by a Government with Intelligence on the Planning Phase
Reports have surfaced — based on Danish and Dutch intelligence sources — suggesting some governments may have received advance indications of a planned attack before it occurred. If true, the content and handling of those warnings, if ever declassified, would be highly informative about both the operation's planning and which governments knew what, when. No government has indicated plans to declassify such material.
Independent Forensic Re-Analysis
The site itself remains accessible to research vessels, though access has been restricted at various points. Independent (non-governmental) forensic analysis of explosive residues, if conducted and published with full methodology, could provide a check on government-held conclusions — though obtaining samples without state cooperation would be extremely difficult given the security posture around the sites.
Conclusion
Where This Mystery Actually Stands
Three years later, the central question remains unanswered. The question of how the Nord Stream pipelines were destroyed is largely settled. Military-grade explosives, placed by divers operating from a vessel with Ukrainian-linked personnel, detonated on 26 September 2022. That much has substantial, convergent, multi-source support.
The question of who decided this should happen, and at what level of authority — remains open. The gap between "we know which boat was probably used" and "we know which government, if any, ordered this" is the entire unresolved core of the mystery, and it is a gap that forensic evidence about explosives and vessels cannot, by itself, close.
What has been effectively ruled out, based on the public record: a simple accident or technical failure (the seismic and forensic evidence against this is overwhelming), and — with declining but not zero plausibility — a unilateral, uncorroborated US Navy operation as described in the Hersh report, which has gained no independent supporting evidence in over two years of intense scrutiny.
What remains genuinely open: whether the Ukrainian operatives identified through the Andromeda investigation acted with state authorisation at any level, what role — if any — Poland-based logistics played beyond convenience, and whether Russia, despite lacking any disclosed forensic link, retains some involvement that has not yet surfaced. The Polish-German extradition standoff suggests that even among NATO allies, there is no shared political appetite to fully resolve this — possibly because full resolution would be uncomfortable for more than one government, regardless of which theory turns out to be correct.
This is, in the end, a case where the absence of an answer is itself the most politically significant fact. A definitive public attribution — in any direction — would have major diplomatic consequences. The current equilibrium, in which evidence accumulates but conclusions remain unstated, may be serving multiple governments' interests simultaneously. That does not mean the truth is unknowable. It means that, as of now, multiple parties appear to have decided that knowing is less useful than not officially saying.
Sources & Further Reading
References
This case involves an active, multi-jurisdictional investigation. Reporting evolves frequently, and details from leaked or sourced material should be read as attributed claims rather than settled fact unless confirmed by official statements.
Swedish Prosecution Authority
Decision to Discontinue the Preliminary Investigation (February 2024)
Official statement closing Sweden's national investigation, citing lack of Swedish jurisdiction to prosecute. aklagare.se
Danish Ministry of Justice / Danish Police
Statement on Closure of Nord Stream Investigation (February 2024)
Confirms sabotage finding while closing the Danish case for insufficient grounds to pursue prosecution. politi.dk
Generalbundesanwalt (German Federal Prosecutor)
Arrest Warrant and Extradition Request Statements (2025)
Source for the active German investigation, the named suspects, and the basis for arrests in Italy and Poland. generalbundesanwalt.de
Wall Street Journal
Investigation into Ukrainian Military Planning (August 2024)
Primary sourcing for Theory 1 — the claim that senior Ukrainian officers conceived the operation independently of Zelensky's direct authorisation. wsj.com
Seymour Hersh (Substack)
How America Took Out The Nord Stream Pipeline (February 2023)
Original source for Theory 3. Single anonymous source; not independently corroborated as of this article's publication. seymourhersh.substack.com
Reuters / Washington Post
Coverage of the Andromeda Investigation and 2025 Arrests
Source for the Andromeda yacht details, HMX explosive traces, and the Italy/Poland arrests of named Ukrainian nationals. reuters.com; washingtonpost.com
UN Security Council
Meeting Records on Nord Stream (2022–2025)
Record of Russia's repeated requests for international investigation and Western members' responses. un.org/securitycouncil
Note: Much of the detailed reporting on this case originates from anonymous sources cited by major news organisations. This article distinguishes between officially confirmed facts (seismic data, investigation closures, arrests) and media-sourced claims (operational details, motives, internal government deliberations), and labels confidence levels accordingly throughout.
Comments
Post a Comment