Who Was Behind the Nord Stream Sabotage? What the Hamburg Trial Can and Cannot Decide

Pipes for Nord Stream 2 stored at Mukran port on Ruegen, October 2019. The photo does not show the damage. Photo: Gerd Fahrenhorst / CC BY 4.0 (cropped).

Three of the four Nord Stream gas pipes were torn open on the floor of the Baltic Sea on 26 September 2022. More than four years later, one man is on trial over it. The Nord Stream trial opened in Hamburg on 14 October 2026, when Serhii K., a 50-year-old Ukrainian man whom Al Jazeera and the AP call a former army officer, appeared before the Higher Regional Court.

He is charged with causing an explosion, damaging property and disrupting public services and, as the AP describes it, with being an accomplice to war crimes. He denies any involvement. ^{[1] [2] [52] [53]}

German prosecutors say he helped plan the attack for state bodies in Ukraine, and press reports say they describe him as its leader. That is an allegation, not a finding. On 27 October the court rejected a defence request to end the proceedings. The ruling was procedural and says nothing about whether he took part. ^{[2] [52] [53]}

The sabotage itself is not in doubt. Seismic records, damage to the pipes and traces of explosives all point to a deliberate attack. ^{[11] [12] [13]} What the public evidence does not show is who was behind it, who paid, or whether anyone at the top of the Ukrainian government knew. One criminal trial of one man may never answer those questions.

Where the case stands:

• Verified: the pipelines were destroyed on purpose. Sweden and Denmark closed their inquiries for different reasons. Germany indicted a defendant, and the Nord Stream trial opened on 14 October (press-reported; the court record was not read). ^{[3] [4] [11] [12] [13] [52]}
• Contested: that Serhii K. took part and acted for Ukrainian state bodies, and his lawyers' argument that he cannot be tried because he cannot speak. ^{[2] [14] [18] [53]}
• Unresolved: who commissioned and paid for the operation, whether any political leader approved it, and the ruling on the defence's motion to dismiss. ^{[21] [53]}

Serhii K. is the only person in the dock of the Nord Stream trial. German court announcements identify him only by his first name and the initial of his surname. ^{[1] [2]}

He is 50. Al Jazeera and the AP call him a former officer in the Ukrainian army. His lawyers say he is still an active-duty soldier. ^{[52] [53]}

He was arrested in Italy in August 2025 on a German warrant and handed over to Germany in late November. ^{[2] [16]} Germany's Federal Court of Justice has twice upheld his detention, in December 2025 and June 2026. Both rulings were about whether the suspicion was strong enough to keep him in custody. Neither decided his guilt. ^{[14] [15]}

A second suspect, reported as Vladimir Z., faces surrender proceedings in Croatia. A Croatian court approved his surrender in September, and his lawyer said he would appeal. He is not on trial in Hamburg. ^{[42] [43] [52]}

Nord Stream 1 was two pipes that carried Russian gas directly to Germany under the Baltic. The first opened in 2011 and the second in 2012. Together they could carry 55 billion cubic metres a year. Gazprom held 51% of the operator. ^[5]

Nord Stream 2 was a second pair of pipes with the same capacity. Gazprom was its only shareholder, and five European energy companies (ENGIE, OMV, Shell, Uniper and Wintershall) had announced financing commitments. ^[6]

It never entered service. In November 2021 the German regulator suspended its certification. ^[7] On 22 February 2022 the German economy ministry withdrew the security-of-supply assessment, which ended the process. ^[8]

By September 2022 Nord Stream 1 was no longer delivering gas. Gazprom had cut deliveries and not resumed them. ^[9] The International Energy Agency traces Russia's supply cuts to late 2021 and says they accelerated through 2022. ^[10]

So the blasts did not switch off a working pipeline. They destroyed pipeline assets and removed options in a crisis that was already under way. That is serious. It is not the same as blaming the explosions for Europe's whole energy shock.

Seismic stations recorded an explosion southeast of the Danish island of Bornholm at 00:03:25 UTC on 26 September 2022. A second cluster of blasts followed northeast of the island from 17:03:50 UTC, about 17 hours later. ^[11]

Three of the four pipes ruptured and leaked. The fourth did not leak. A 2026 English High Court judgment records that experts agreed it was damaged from outside anyway. ^[13]

Swedish investigators recovered objects from the seabed and reported explosive traces on them. They called it gross sabotage. ^[12] Danish police and the Danish intelligence service reached the same view: the damage was deliberate. ^[4]

There are limits. The laboratory files, samples and chain of custody behind the Swedish finding have not been made public. ^[12] But the physical record points to a deliberate attack, and no public evidence supports an accident.

None of this names a culprit. Proof that someone blew up the pipes is not proof of who. For a separate undersea-cable case, see our GUGI investigation.

The indictment filed by Germany's Federal Prosecutor on 30 June 2026 lists four charges. Three are domestic: causing an explosion, destroying structures (the AP calls it damaging property) and disrupting public services. The fourth, as the AP describes it, is being an accomplice to war crimes: an alleged attack on civilian objects during an armed conflict. ^{[2] [53]}

Prosecutors say he was an army officer who worked with other military personnel to plan the operation for state bodies in Ukraine. They say the aim was to stop gas deliveries for good and deny Russia revenue for its war.

The Federal Prosecutor's release charges him as a co-perpetrator, meaning joint commission, not as a mere helper. The AP's word "accomplice" is not the Federal Prosecutor's wording, and we follow the prosecutor's release. ^[2] Press reports say prosecutors describe him as the leader of the group. ^[52]

He denies involvement. His lawyer, Nicola Canestrini, told the German broadcaster ZDF that he was in Ukraine when the explosions happened. ZDF also reported that the indictment contains no fingerprint or DNA match placing him on the yacht prosecutors say was used. ^[18]

Those points matter, but they have limits. Being somewhere else on the day of the blasts would not rule out earlier planning. A missing DNA match does not cancel other evidence. And an alibi told to a broadcaster is not an alibi tested in court. ^[18]

His lawyers have also argued, in a separate line of defence, that a military strike on a route that benefited Russia could be lawful, and that a soldier following orders may be protected. Making that argument is not an admission that he did it. ^{[18] [19]} In a provisional detention ruling in 2025, Germany's Federal Court of Justice rejected the lawful-war argument on the evidence then available. It reasoned that civilian gas pipes do not become military targets merely because their revenue helps pay for a war. ^[14]

Investigative reporting names a chartered sailing yacht, the Andromeda, as the centre of the case. Prosecutors say a group used a yacht in the operation, and the reporting links this one's charter and travel records to the people they accuse. ^{[2] [19] [21]} A rental record does not by itself prove an attack. It is a lead that the court now has to test.

The public evidence falls into four groups:

• Identity and travel. The Federal Court of Justice described photographs, passport and border records and an expert comparison. They can show who was where. They do not show intent. ^[14]
• Traces on the boat. Swedish investigators reported findings at the scene, and the media have described yacht evidence. A trace on an object is not automatically a trace left by this defendant. ^{[12] [18]}
• Phone calls and devices. A joint investigation by German public broadcasters reported on the indictment, including intercepted calls made while he was held in Italy. The recordings and their full context have not been inspected here. ^[19]
• Who gave the orders. Prosecutors allege Ukrainian state direction. The Federal Court of Justice, at the detention stage, reached a provisional view that it was probable. Separate reporting points to senior commanders. These overlap, so they are not three independent proofs. ^{[2] [14] [21]}

The broadcasters reported remarks in Italian detention that, if authentic and understood in context, would support a claim of official military involvement rather than a freelance operation. They also reported the defence's rejection of that reading. ^[19] Press quotations cannot settle what was meant, whether it was voluntary or how it was translated. That is for the court.

Taken together, this is the most detailed public case we found linking alleged participants to the attack. It is still a case to be tested, not a conclusion.

Sweden's prosecutor closed its inquiry in February 2024 because Sweden had no jurisdiction. It passed material it could use to Germany. ^[3]

Denmark closed its inquiry weeks later. Danish police said the sabotage was deliberate but there was not enough basis for a Danish criminal case. ^[4] Those are two different decisions, and neither says there was no evidence.

In its December 2025 detention ruling, the Federal Court of Justice reasoned, provisionally, that the damage to German-linked infrastructure gave Germany a basis to prosecute under the rule that treats the place where an offence takes effect as a place of the offence. It also pointed to a separate rule that lets Germany prosecute certain international crimes committed abroad. ^{[14] [30] [31]}

Higher regional courts hear such cases at first instance. ^[32] Hamburg is the court named in the court's own announcement. ^[1]

Russia opened its own terrorism investigation in 2022 and has accused Western states. Its case file has not been seen, so its account is a statement of position, not independent proof. ^[29] A Russian-backed proposal for a United Nations inquiry failed on 27 March 2023, with three votes in favour, none against and twelve abstentions. ^[28]

Hamburg admitted the indictment on 2 September 2026. ^[1] On 30 September it rejected applications by the pipeline operators to join the Nord Stream trial as co-plaintiffs. The court said the criminal case concerns the defendant's act and guilt, not a wider geopolitical reconstruction. The ruling does not bar evidence about who commissioned the operation, and the operators can reapply if circumstances change. ^[17]

On 27 October the Hamburg court rejected a defence request to stop the proceedings. According to the Associated Press, his lawyers argued that Serhii K. is still an active-duty soldier and that Ukrainian law bars him from speaking for national-security reasons. Under German law, they said, a person who cannot speak cannot be convicted. ^[53]

The court disagreed. It said German law does not limit his right to a defence, and that a foreign state's service conditions do not restrict his freedom to testify in Germany. His lawyers then filed a motion to dismiss. This research found no ruling on it. ^[53]

The BBC reported on 10 October that he planned to stay silent and that his lawyers would use sworn statements from military superiors about limits on discussing military activity. The 27 October argument is similar in theme, but no source says the two are connected. ^[20]

Three cautions apply. The ruling is procedural and does not touch the question of guilt. The defence argument does not admit anything, and silence is not a confession. And the claim of continuing active service comes from the defence in a single wire report, not from the court record. ^[53]

What the prosecution must prove in the Nord Stream trial

To send the case to trial, the court needed only "sufficient suspicion". A conviction needs the court's own conviction from the evidence at trial, with certainty enough to silence reasonable doubt. ^{[33] [34] [35]} The defendant does not have to solve the crime or name another attacker.

For the war-crime count, the court must find an armed conflict, protected civilian objects, an attack, the defendant's part in it and the required intent. It is not enough to call the pipelines strategic. ^{[14] [30]} The offence existed before the attack. A 2024 amendment, which changed the wording on environmental war crimes, should not be treated as creating the charge after the fact. ^{[40] [41]}

The domestic counts have their own tests. The court must link the pipes, their damage and their role to the explosion, destruction and public-service offences, and show his part. ^{[2] [48] [49] [50]} Failing on the war-crime count would not automatically defeat those charges, and proving them would not automatically prove a war crime. ^{[2] [30]}

Prosecutors call him a co-perpetrator. That means joint commission. It does not require proof that he personally did every physical act, but it does require more than nationality or association. ^{[2] [14] [51]}

The "following orders" defence

The defence can lean on a narrow rule in German law on orders. A soldier who follows a binding order may escape blame if the order's unlawfulness was not obvious. ^[39] That is different from state immunity and from the claim that the pipes were a lawful target. Calling them all "immunity" blurs what the court has to decide. ^[14]

What the court can look at, and where it stops

The court has a duty to look into evidence that bears on its decision. It can hear witnesses and experts and examine records. It can look into who commissioned the operation if that bears on the charged act, his role or his intent. ^[36]

But it judges the charged act, not the whole geopolitical story. ^[37]

It cannot simply order foreign governments to open their archives. Overseas witnesses may not come, and protected intelligence may be withheld. German law lets officials refuse to hand over some documents to protect the state. That is a possibility, not proof that it has happened here. ^[38]

Why command may stay unanswered

A conviction could establish his liability and whatever else the court finds. It would not automatically prove that Ukraine's president knew or approved.

An acquittal could mean only that the case against him was not proved. It would not identify the real attackers. Read the court's reasons before turning either result into a headline.

Ukrainian state direction. This is the prosecution's case. It rests on an indictment, a provisional judicial view and reported identification and communications evidence, so it is stronger than any theory built on motive alone.

Its weak point is the gap between a named participant and a named authority. The public releases allege state direction without showing a complete chain of orders. Ukraine's president has denied that his country was involved. ^{[2] [14] [18] [19] [53]}

A freelance or disobedient Ukrainian group. A 2024 Wall Street Journal account describes private funding and military participation. It says President Zelenskyy first approved the plan, then tried to cancel it, and that the team went ahead. Zelenskyy has denied Ukrainian involvement, and the report says German investigators at that time lacked direct evidence linking him.

It includes denials from Ukraine's then commander-in-chief, Valerii Zaluzhnyi, and from security officials. Those are disputed allegations from anonymous sources, not established decisions. ^{[21] [53]}

Russia, or a trail meant to point at Ukraine. Nordic broadcasters used radio and satellite data to place Russian vessels near the northern damage area before the attack. That makes naval activity a fair subject of inquiry, but it does not show what happened underwater or link a ship to the blasts. The reporting also discusses Danish observation of a specialised Russian vessel. The broadcasters count as one investigative chain, and we did not re-analyse their raw data. ^[22]

Russian capability and motive are not proof. Nor does damage to pipelines that Gazprom controlled rule out Russian involvement. A planted-evidence theory needs evidence of fabrication. We found none in the public record, though we have not ruled out every alternative.

The United States and Norway. Journalist Seymour Hersh wrote in February 2023 that the US carried out the attack with Norwegian help. His account rests on one anonymous source, and the full original is behind a paywall. ^[23] Norwegian fact-checkers found errors in its claims about specific ships and aircraft. ^[24] Incomplete open tracking cannot rule out every conceivable covert operation, The account still rests on one anonymous source and has not been corroborated.

President Biden said in February 2022 that the US would end Nord Stream 2 if Russia invaded. That shows policy opposition, not an admission of anything later. Certification was in fact halted through a regulatory process. ^{[8] [44]} Claims that American or Norwegian suppliers benefited afterwards are arguments about motive, not proof.

Denmark's Energy Agency reported that an object it recovered near Nord Stream 2 in March 2023 was an empty smoke buoy. That report establishes no link to the sabotage. ^[25]

An accident, or someone not yet identified. An accident is a poor fit for the physical record. A further actor or go-between is possible, but possibility is not evidence.

Climate and sea. A 2025 study in Nature estimates that 465,000 tonnes of methane, give or take 20,000, entered the atmosphere. ^[26] A second study found raised dissolved methane across about 14% of the Baltic. That measures how far the gas spread, not how much life was harmed. ^[27]

Energy. The damage is to assets and future supply options in a market already hit by Russian supply cuts, war and policy shifts. A fair estimate of the blasts' own effect on prices would need a baseline that separates them from all of that. None exists here. ^{[9] [10]} For how exposed other energy routes are, see our piece on what closing the Strait of Hormuz really means.

Restarting. An unleaked pipe is not a ready pipeline. The EU introduced a Nord Stream-specific transaction ban in 2025, with exceptions, and a July 2026 amendment clarified when those exceptions apply. That does not mean every inspection is banned. ^{[45] [46] [47]}

Insurance. In July 2026 an English court ruled in Nord Stream AG v Lloyd's Insurance Company SA. The judge declined to pick the most likely perpetrator and held that a war exclusion applied on the theories he considered. It was a civil coverage decision. It is not a finding of guilt, and its balance-of-probabilities reasoning is not the standard for a criminal conviction in Hamburg. ^[13]

Press reports say the Nord Stream trial is expected to run into February 2027. ^[52] The reports found so far describe the prosecution's allegations and one procedural ruling. They do not show which exhibits were admitted or how witnesses fared.

Four things are worth watching:

• the ruling on the defence's motion to dismiss;
• whether Serhii K. testifies, and what he says;
• which witnesses and experts the court hears;
• what the court says about who commissioned the operation.

What would change the assessment is not another anonymous headline. It is a tested exhibit, a witness cross-examined in court, or a reasoned finding with a traceable source. Four kinds of evidence would matter most:

• laboratory files that show where the samples came from, how they were handled and whether any other explanation fits;
• authenticated orders, funding transfers or cross-examined witnesses that name who commissioned the operation;
• a demonstrated link to another actor, or proof that the current chain of evidence was fabricated or misread;
• direct records that tie a named leader to a decision to approve, cancel or know.

The facts come from court and prosecutor records, statute texts, regulator and energy-agency reports, scientific studies and original investigative reporting. We separated what officials assert from what can be observed, and prosecution from judicial reasoning. A detention or trial-opening decision is not a conviction. Reporting that repeats one source counts as one source.

Our account of the trial on 14 and 27 October comes from two press reports, Al Jazeera and the Associated Press, read on 3 November 2026. We did not read the court's own record. ^{[52] [53]}

We did not obtain the full indictment, the Nordic forensic files, the original recordings, authenticated military orders or Russia's case file. The UN vote was confirmed from an official compilation, not the meeting record. ^[28] German, Danish, Swedish and Norwegian passages were read for meaning, and the English renderings are not official translations.

We read the Wall Street Journal's 2024 account through an attributed republication, did not read Hersh's original behind its paywall, and took the February 2022 certification decision from the regulator's report. We conducted no confidential interviews.

The sabotage is established. Three of the four pipes ruptured, the fourth was damaged from outside, and Sweden and Denmark closed their inquiries for different reasons. Germany indicted a defendant, and the Nord Stream trial opened on 14 October (press-reported). ^{[1] [3] [4] [11] [12] [13] [52] [53]}

Whether Serhii K. took part and acted for Ukrainian state bodies is contested. The case has real support: a formal indictment, a provisional judicial view and reported identification and communications evidence.

It also faces a denial and a legal challenge the court rejected on 27 October. The defence then filed a motion to dismiss, and the reports found do not say how it was decided. The underlying record is not public, and guilt has not been decided. ^{[2] [14] [18] [53]}

Who commissioned and paid for the operation is unresolved. That includes whether any president knew or approved. The court can look at those links while judging one defendant, but it can reach a sound verdict without settling them. The English insurance judgment does not fill that gap. ^{[13] [17] [21]}

At the last report found, on 27 October, the Nord Stream trial was two weeks old. Who was behind the sabotage is not settled. Someone destroyed the pipelines on purpose, a court is now testing the case against one man, and who commissioned the attack may never be established in that trial.