Involvement of Russia CNN reported that European security officials observed Russian Navy support ships nearby where the leaks later occurred on 26 and 27 September. One week prior, Russian submarines were also observed nearby. In September 2022, the former head of Germany's
Federal Intelligence Service (BND), Gerhard Schindler, alleged that Russia sabotaged the gas pipelines to justify their halting of gas supplies before the explosion and said Russia's "halt in gas supplies can now be justified simply by pointing to the defective pipelines, without having to advance alleged turbine problems or other unconvincing arguments for breaking supply contracts.” Finland's national public broadcasting company
Yle compared the incident to the
two explosions on a gas pipeline in
North Ossetia in January 2006, which were caused by remote-controlled military-grade charges. The explosions halted Russian gas supply to Georgia after the country had
started seeking NATO membership. On 25 March 2023
T-Online reported on Russian naval activity near the Nord Steam pipelines just a few days before the explosions. On 19 September the Russian Baltic Fleet began maneuvers involving vessels and
313th Spetsnaz Special Forces frogmen out of the
Baltiysk naval base. On 21 September the
SS-750 salvage ship, which is designed for specialized underwater operations and able to launch the AS-26
Priz-class mini-submarine left Baltiysk with its
AIS inactive. Analysis of satellite imagery and AIS-data indicate that the following day
SS-750 was operating in the area together with five other Russian naval vessels including the rescue tugs
SB-123 and
Alexander Frolov that are capable of lowering into the sea objects weighing hundreds of kilograms such as mines and other explosive devices. Also in March the Danish and the Norwegian engineering newspapers
Ingeniøren and
Teknisk Ukeblad cited a named
lieutenant commander of the Danish navy and analyst at the
Royal Danish Defence College for reasoning that the sabotage used several hundreds of kilograms of explosives likely in the form of a
naval bottom mine with of explosives.
T-Online additionally reported that on 22 September when the six Russian navy ships were operating in the area a Danish navy patrol boat and Swedish navy and air force were also present. On 27 April 2023 the Defence Command was again cited for a statement obtained by
Information that confirmed T-Online's 25 March report that the
SS-750 salvage ship was among six Russian navy ships operating in the area. On 3 May 2023, an investigation by the Nordic public broadcasters
DR,
NRK,
SVT, and
Yle described "highly unusual" movements by ships thought to include Russian ships such as the tugboat SB-123, naval research vessel Sibiryakov, and another unspecified ship from the naval fleet. These ships had their transmitters turned off, and were reported to be in the area of the explosions between June up until 22 September 2022. In May 2023, German newspaper
Süddeutsche Zeitung reported that although the "[s]abotage last September has been linked to Russia", German investigators were sceptical as to whether the sabotage was carried out by Russian naval ships. Later in May,
Der Spiegel newspaper wrote that a "false flag" operation by Russia is considered extremely unlikely "among people familiar with the process". In June 2023, the Biden administration publicly deflected questions regarding the perpetrators while Biden administration officials conceded in private that no conclusive evidence points to Moscow being behind the sabotage.
The Andromeda as a false flag In April 2023, German Defense Minister
Boris Pistorius cautioned against making premature accusations as to whom was behind the attack, suggesting that the alleged Ukrainian use of the 50-foot-sailing Yacht
Andromeda might be a
false flag operation. In July 2023,
RTL and
n-tv reported that
Andromeda, believed by German investigators to have played a role in the sabotage, had been rented by a company owned by a named woman originally from
Uzbekistan, who holds a Russian and a Ukrainian passport, who is registered to an address in
Kerch on the
Russia annexed peninsula
Crimea and who in June 2023 was posting to social media from
Krasnodar in Russia. Commenting on these findings, member of the German Bundestag
Roderich Kiesewetter said "Russia was involved in this attack". In September 2023,
Andreas Umland, analyst at the
Stockholm Centre for Eastern European Studies, argued that the
Andromeda was most likely a false flag created by Russia to implicate Ukraine. Umland argued that Russia may have attempted "to kill two birds with one stone" and not only avoid that Gazprom should pay compensation for undelivered gas, but also to threaten the support from allies to Ukraine in its defense against the Russian invasion of Ukraine. Umland further argued that Ukraine had no interest in sabotaging the already "dead" pipelines, since Ukraine had other priorities with a war in their country. According to Umland, Russia had the strongest motives for the sabotage. Further, Umland saw a pattern in Russia's behavior, because after Russian-controlled forces had shot down
Malaysia Airlines Flight 17, Russia tried to frame Ukraine for this crime as well. Also in September 2023, Poland's Secretary of State and coordinator of Poland's intelligence agencies
Stanislaw Zaryn similarly told reporters that the Polish government alleged that
Andromeda had links to Russian espionage, and that Russia was behind the attack and that "we have no evidence for this yacht's participation in the events". Without providing evidence, Zaryn went on to state that
Andromedas voyage had a "purely touristic character" with a crew "who were looking for fun" and where nobody seemed "to have anything close to military or sabotage-related training". The
Kremlin has denied responsibility for the attack. and later the United States, of being responsible for the sabotage.
The New York Times reported that the CIA had warned various European governments sometime in June. In February 2026,
Der Spiegel reported that CIA operatives had met with Ukrainian sabotage specialists in Kyiv in spring 2022 and, according to Ukrainian sources familiar with the meetings, had initially appeared sympathetic to the pipeline attack plan and discussed technical details of the operation. The same sources said that at a second meeting the CIA signaled support for proceeding. The CIA called the report "completely and utterly false". According to the Der Spiegel, the CIA later reversed course and warned the Ukrainians against proceeding, with a CIA representative at the Kyiv station raising the matter at the Ukrainian presidential office; the warnings were disregarded. At a
United Nations Security Council meeting convened for the incident, Russian Federation representative
Vasily Nebenzya suggested that the United States was involved in the pipeline damage.
Deutsche Welle fact check concluded that the Russian claim "that an American helicopter was responsible for the gas leaks" is untenable and misleading. The helicopter never flew along the pipeline and the gas leak areas were at least away, respectively, from its flight path. On 8 February 2023, American investigative journalist
Seymour Hersh published an article in his newsletter alleging that the attack was ordered by the White House and carried out utilizing American and Norwegian assets by mining the pipelines in June during
BALTOPS 2022 with a subsequent remote controlled detonation. The post relied on a single anonymous source, whom Hersh described as having "direct knowledge of the operational planning." The White House responded to the story by calling it "utterly false and complete fiction". The
Norwegian Ministry of Foreign Affairs said that those allegations are "nonsense". Norwegian commentator challenged the accuracy of Hersh's claims, such as the notion that
Alta-class minesweepers had participated in BALTOPS 2022, or that NATO Secretary General
Jens Stoltenberg had been cooperating with US intelligence since the
Vietnam War, when he was a teenager and fervently opposed to NATO. Subsequently, Hersh stated that the trail the German investigators were following on the "pro-Ukrainian group" that used a rented yacht was a
false flag fabrication created by the CIA and fed to US and German outlets. On the second anniversary of the Nord Stream pipelines sabotage the
Christiansø port
harbourmaster, John Anker Nielsen, stated that four-five days before the sabotage he had sailed out with the rescue service towards some ships with inactive transponders that turned out to be American naval ships and the Danish naval command had instructed the rescue service to turn back. In October 2024 the Swiss magazine
Die Weltwoche noted that the three months earlier had participated in
BALTOPS 2022 that exercised unmanned underwater vehicles suitable for demining and other underwater operations, and that as such these vessels could transport explosive charges suitable for blowing the Nord Stream pipelines. The Swiss newspaper claimed this new information calls into question the assumption that a Ukrainian group was responsible for the sabotage and that investigations are continuing.
Involvement of Ukraine In March 2023, several international media outlets, citing anonymous sources, reported that a pro-Ukrainian group may have carried out the attack using the , a
Cruiser 50 sailing yacht from
Bavaria Yachtbau. According to these reports, investigators found explosive residues on the
Andromeda and that it had been rented by six people with professionally forged passports, for a Polish company with two Ukrainian owners. The yacht is said have left
Rostock on 6 September, briefly mooring at the port of
Wiek and at the Danish island
Christiansø, which is located from the explosion site. Naval experts from Germany, Sweden and Denmark including
lieutenant commander of the Danish navy and analyst at the
Royal Danish Defence College J. Riber scoffed at the idea that a 50-foot sailing yacht could be used for such a spectacular attack. The naval experts point out that even with very skilled divers it would be extremely challenging for the crew of 6 to place at depth the explosives needed to create 2.5-Richter blasts. In August 2024 German TV station ARD conducted an experiment, hiring the very "Andromeda" yacht that was allegedly used in the sabotage and trying to replicate the scenario implicated by the investigators with professional divers. The experiment failed, as the yacht was described as completely unsuitable for diving. The TV then rented a professional diving ship and tried again, but concluded it would be "very difficult and dangerous" for two divers even using that vessel designed for diving. The February 2026
Der Spiegel article said that the operation had been approved by then-commander-in-chief
Valerii Zaluzhny but not by President Zelenskyy, whose office was not informed. The report named a private Ukrainian citizen as the primary financier, covering approximately $300,000 in costs. Ukrainian presidential advisor
Mykhailo Podolyak has also denied that Ukraine was behind the sabotage and instead blamed it on Russia.
Further speculation According to a European lawmaker briefed in late 2022 by his country's main foreign intelligence service, investigators had been gathering information about an estimated 45 "ghost ships" whose location transponders were not on or were not working when they passed through the area, possibly to cloak their movements. The lawmaker was also told that more than of "military grade" explosives were used by the perpetrators. == Aftermath ==