Russian-linked Telegram groups offered crypto for European attacks, study reports
Study: Russian actors recruit young Europeans through Telegram 'com networks'
A study by the Institute for Strategic Dialogue (ISD), shared with the UK's i Paper, reports that Russian actors are using Telegram groups and cryptocurrency payments to recruit teenagers and young adults across Europe for sabotage and violent attacks.
According to the study, participants in these Telegram groups — known as "com networks" — compete for social status by uploading harmful content.
Key claims in the report
- ISD says it found "multiple indicators suggesting possible Russian state-linked support" for parts of the network.
- Study author Steven Rai says Russia-linked chats have offered crypto for arson attacks, calling such payments "completely new."
- The i Paper identified two clips shared in the groups that were filmed in the UK, including one showing a car belonging to a care worker being smashed.
- Ukrainian police arrested two boys, aged 11 and 15, over an alleged plan to attack their school "on the orders of the Russian Federation."
What the ISD study reports
The study says organizers of the networks "mirror established Russian methods for recruiting 'disposable agents' for violence abroad." ISD describes this as possible state-linked support rather than confirmed state control.
An umbrella group linking several of these networks says it wants to bring participants of different views together with "one goal": to cause chaos, according to the study.
Reported incidents in the UK and Ukraine
The i Paper found two clips in the groups that were filmed in the UK. One showed someone smashing a car that belonged to a care worker. Another appeared to show the same person throwing a brick through the window of a house.
One week after those incidents, Ukrainian police arrested two boys aged 11 and 15 who were allegedly planning to attack their school with guns and explosives. Ukraine's Security Service described the incidents as a Russian intelligence operation.
A section of the umbrella group claims to be allied with Direct Action, described as a Russian-linked far-right group that organised the firebombing of former UK Prime Minister Sir Keir Starmer's home. In that case, thousands of dollars in USDT — a stablecoin, meaning a digital token pegged to the US dollar — was reportedly offered to a 22-year-old Ukrainian in return for carrying out attacks aimed at attracting press coverage.
What is confirmed
The ISD study exists and was shared with the i Paper. Ukrainian police did arrest two boys aged 11 and 15, and Ukraine's Security Service publicly described the case as a Russian intelligence operation. Two clips filmed in the UK were identified within the Telegram groups.
What remains unclear
Whether the Russian state directs or funds these networks is not established. ISD points only to "possible Russian state-linked support." The claim that crypto was offered for arson comes from the study's author and has not been independently verified. The study does not confirm that every person appearing in the shared clips was recruited through the network.
Why this matters for crypto
The reports point to a new alleged role for digital tokens in cross-border recruitment: payments that can be sent to young people in different countries without going through a bank. The reported use of USDT, a dollar-pegged stablecoin, shows how such tokens can be offered as payment for criminal acts, according to the study's findings.