The €20 Saboteur: How Telegram and Crypto Are Powering Russia’s Low-Cost Hybrid War in Europe

For European security services, the significance lies in the economics of the operation. A trained intelligence asset is expensive, difficult to replace and potentially difficult to extract. An anonymous recruit found online can be approached, paid in cryptocurrency and discarded with little loss if detected. That changes the problem intelligence agencies have to solve.

From €20 photographs to physical sabotage

According to Alexandru Musteață, director of Moldova’s Information and Security Service, a recruit may initially be asked to photograph a building, an intersection or a piece of infrastructure, or simply confirm details about a location. The payment can be as little as €20, €50, or €100.

The amount matters less than the process. Once someone accepts one assignment, the recruiter has established that the person is willing to act on instructions from an unknown contact. The next task can therefore be more demanding, with higher payments and greater risks.

The progression can eventually lead to acts of sabotage, including placing concealed objects such as bags beneath vehicles or targeting defence-related facilities.

What looks like a sequence of unrelated freelance jobs is therefore an intelligence funnel. The recruit is not necessarily recruited as a spy in any conventional sense. They are tested, conditioned, and gradually exposed to more consequential activity.

That makes the model particularly difficult to police. The first contact may not look criminal at all.

The people involved may also have little understanding of the strategic operation in which they have become participants. SIS describes them as low-value or low-level agents. Their value to the organiser comes precisely from the fact that they are replaceable.

The outsourcing of the dangerous part

Traditional espionage depends on people who can be trained, managed and trusted. Cross-border sabotage historically required networks capable of moving personnel, equipment and money while avoiding detection.

Digital recruitment removes much of that infrastructure.

Messaging platforms provide the initial contact. Cryptocurrency can provide payment without relying on conventional banking channels. The physical task is performed by someone who may have no previous connection to the intelligence service directing the operation.

The result is an unusual division of labour. The organiser retains distance from the operation while the person on the ground assumes almost all of the immediate risk.

This is why the small sums being offered should not be dismissed as evidence of amateurism. They are part of the model. If a €20 payment produces useful reconnaissance, the cost is negligible. If an agent is arrested, another can potentially be recruited.

For an intelligence service seeking deniability, that expendability is an asset.

The model also changes the meaning of a security perimeter. The threat no longer has to cross a border as a trained operative. The border can be crossed by a civilian who has been recruited digitally and given a task.

Why Moldova is part of Ukraine’s security problem

The geographic pattern identified by SIS is revealing. Most of the confirmed operations involving recruited Moldovan citizens have been directed at targets in Ukraine.

Moldova occupies a position where its domestic security environment is closely tied to the war next door. Since Russia’s full-scale invasion of Ukraine in 2022, Moldovan and Ukrainian security cooperation has deepened, including joint operations against recruitment and sabotage networks.

For hostile intelligence services, Moldova offers another pool of potential recruits outside the immediate Ukrainian security environment. A person living in Moldova can be contacted remotely and directed towards a target in Ukraine without the recruiter having to establish a conventional operational network inside the country.

That creates a security chain running across jurisdictions.

Moldovan authorities have worked with Ukrainian counterparts to detain recruited individuals, while SIS has also conducted operations of its own that have not been publicly disclosed. The details of those operations remain limited, but the institutional response points to the same problem: counter-intelligence is no longer confined to monitoring known agents or conventional espionage networks.

It increasingly means finding suspicious relationships among ordinary users of digital platforms.

Moldova is not an isolated case

The pattern is already visible elsewhere in Europe.

Germany recorded more than 165 suspected acts of sabotage in the first part of 2026. In July, a Moldovan national was detained in Bavaria on suspicion of conducting drone reconnaissance over a facility belonging to defence manufacturer KNDS.

Denmark’s security and intelligence service has likewise reported attempts by Russian intelligence to recruit ordinary people through social media and gaming platforms to photograph defence plants and critical infrastructure.

The details differ between cases, but the recruitment logic is remarkably consistent: unsolicited contact, an offer of easy money, a harmless-looking first assignment and increasing demands once the recruit has demonstrated compliance.

That consistency matters more than any individual arrest. It indicates a repeatable method rather than a collection of isolated criminal schemes.

The digital environment is effectively supplying hostile intelligence services with a much larger recruitment market.

The security problem is also a social one

The model depends on more than technology. It exploits the gap between the value of information to a state and the value of a small payment to an individual.

A photograph that earns €20 may have little significance to the person taking it. For an intelligence service, however, repeated observations of infrastructure, movements or facilities can contribute to a larger picture.

The recruit therefore does not need to understand the operation's strategic purpose. The system works by fragmenting it.

One person photographs a location. Another verifies a detail. Someone else moves an object. Each participant sees only a small part of the wider operation.

That fragmentation is useful to the organiser and dangerous for the individual. The person performing the task is exposed to arrest, prosecution and physical danger while receiving only a fraction of the value generated by the operation.

The imbalance is extreme.

The Moldovan service's warning is consequently not simply about preventing individual acts of sabotage. It is about stopping a recruitment ecosystem from becoming established.

Preparing for the threat to move home

SIS says that no acts of sabotage carried out by these recruited agents have yet been publicly confirmed inside Moldova. But the service is preparing for the possibility that the same tactics will expand onto Moldovan territory.

That distinction is important. The immediate threat is concentrated largely in Ukraine, but the mechanism does not depend on geography.

Once recruiters have demonstrated that people can be found, tested, and paid remotely, there is little operational reason for the model to remain confined to one country. The same infrastructure can be used to seek photographs of Moldovan critical infrastructure, identify vulnerable sites or recruit people for physical operations.

For Moldova, the challenge is therefore not simply to arrest individual recruits. It is to identify the recruitment pipeline early enough to prevent the escalation from beginning.

That requires intelligence services to watch a space that sits awkwardly between conventional crime, online manipulation and state espionage.

The old distinction between a spy and an ordinary citizen acting for money is becoming less useful. A person does not need training, ideology or a formal relationship with an intelligence service to become an operational asset.

Telegram and cryptocurrency have lowered the barriers further. The recruiter can remain remote, the payment can remain pseudonymous, and the operative can remain disposable.