American officials familiar with intelligence reporting on the August 5 incident at Leipzig/Halle Airport have tied the explosive drone found there to Russian state services. The assessment reached the Wall Street Journal through anonymous sources, and a US defense official in Europe separately told CNN the device carried military-grade explosives and pointed to a Russian intelligence service. Neither account came with a name, a rank, or a public German endorsement.
That last part is the interesting one.
The device
Airport operations were suspended overnight on August 5 after a suspicious object turned up on the apron, within a few metres of a Ukrainian Antonov An-124. Federal police classified it as a possible improvised explosive device. Attached to the airframe of the drone was a charge that forensic examiners assessed as high military grade, reported by some outlets as Semtex. An ordnance disposal unit removed the detonator.
The charge never went off. German security authorities attribute that to a faulty detonator, and Bild has cited investigators describing a technical defect in the firing mechanism. Whoever placed it did the hard part, which is getting an armed device into a secured cargo apron at a NATO logistics node and positioning it beside a specific aircraft. The part that failed was the cheap part.
Reporting by Süddeutsche Zeitung, NDR and WDR, drawing on a confidential police report, says the An-124 was loaded with military ammunition. Other accounts have that detail as subsequently walked back. Either way, the aircraft type and the location tell you enough about what it was there to do.
Why Leipzig
Leipzig/Halle is not a generic freight hub that happens to be German. It is the main operating base for the Strategic Airlift International Solution, the arrangement through which NATO members lease Antonov heavy-lift capacity to move oversized equipment. Since 2022 that fleet has been central to reinforcing the alliance’s eastern flank, and Antonov Airlines keeps its aircraft based there. Berlin designates the airport as critical infrastructure.
An An-124 is one of a very small number of airframes on the planet that can swallow a helicopter or a bridge-layer. There are not many of them, they cannot be replaced on any relevant timescale, and a meaningful share of what remains flyable belongs to a Ukrainian operator. Destroying one on the ground removes a capability rather than a shipment. That is a different order of target than a container.
The second time
The same airport burned in July 2024, when an incendiary charge concealed in an electric massager ignited in a DHL container before it could be loaded onto a Britain-bound flight. Lithuanian prosecutors have since charged fifteen people over that operation and linked its organisers to Russian military intelligence. Polish investigators described the parcel run as a test of a channel intended for aircraft heading to North America.
Set the two incidents side by side and the trajectory is legible. The 2024 operation attacked the commercial freight chain using concealed incendiaries and third-party couriers, with plausible deniability built into the method. The 2026 operation put a bomb on an airport apron, next to a named aircraft, in the military airlift chain. The concealment is gone. The proxy layer is thinner. The target has moved from cargo to capability.
There is also the matter of what else happened that night. A freight jet performing a go-around near the airport struck an unidentified object and was damaged in flight. German authorities were still searching for debris two days later, and nobody has publicly connected the two events. As coincidences go, it is doing a great deal of work.
The attribution gap
Alexander Dobrindt has called the incident a new threat scenario and said the investigation must determine whether foreign states were involved. He has not said Russia. Roderich Kiesewetter, who sits on the Bundestag’s intelligence oversight committee, has. So has Ukraine’s ambassador in Berlin, Oleksii Makeiev, who asked publicly who else it could possibly be.
So the sequence is: German security services find the device, German media report the forensics, a German lawmaker names Moscow, the Ukrainian ambassador names Moscow, and the formal attribution arrives in an American newspaper from officials who will not be identified.
Berlin has reasons for the silence. A criminal investigation is running, and formal state attribution carries consequences under alliance politics that a leaked assessment does not. But the gap is the operational point. An adversary conducting sabotage against NATO logistics is testing not only whether the device works, but how long it takes the target government to say the word out loud, and what follows when it does. On the evidence so far, the answers are a while, and not much.
The detonator failed. Nothing else did.