Developing story
We are following this story for new developments and will update this article when significant news emerges.
Monitored since 5 November 2026 | no updates yet
Key takeaways
- NABU and SAPO allege senior SBU, police and prosecutor officials protected fraudulent call centres for bribes; no court has ruled.
- SBU dismissed two officers and police suspended others; Reuters says tackling high-level corruption is key to Ukraine's EU bid.
- Investigators allege group members sought to curb the agencies' independence in 2025, a claim no court has tested.
Detectives from Ukraine's National Anti-Corruption Bureau (NABU) were prevented from entering premises they were due to search on the morning of Wednesday 4 November. NABU said one of the senior officials of the Security Service of Ukraine (SBU) threatened to use a firearm. The detectives were acting on a ruling by a judge of the High Anti-Corruption Court. NABU also said SBU special forces arrived at the scene and called the steps "unacceptable". The SBU confirmed that NABU and the Specialised Anti-Corruption Prosecutor's Office (SAPO) searched the offices of its employees that morning, in ongoing proceedings under court orders.
Later that day NABU and SAPO announced that they had exposed a criminal organisation. They allege its members systematically bribed senior law enforcement officials so that scam call centres and other illegal businesses could operate without interference, according to Ukrainska Pravda. They say serving officials of the SBU, the National Police and the Prosecutor General's Office (PGO) were involved. The case is part of Operation Carthage, whose first phase NABU and SAPO unveiled in September. The SBU said it had dismissed two senior officers, and the National Police said it had suspended officers. No court has established guilt. Everything attributed below to investigators is an allegation.
What investigators allege
NABU and SAPO say the organisation had at least 12 members. Beyond serving officials, they say it included "representatives of the criminal underworld" (Ukrainska Pravda). Hromadske, NV and Babel report that the group allegedly protected at least 52 fraudulent call centres employing about 2,700 people, who defrauded victims in Ukraine and abroad. Hromadske, Liga and Babel report the alleged payment as $7,000 per centre per month, in cryptocurrency. NV separately reports that officials received "millions of dollars" in cryptocurrency each month.
The investigators also allege drug sales, counterfeit cigarettes and fake foreign currency. Hromadske and NV report that a facility to print counterfeit euro banknotes was set up in 2026. They also allege assaults, abductions, torture and extortion.
The video the agencies released uses codenames. "Criminal" is the alleged founder and leader, with three prior convictions. Ukrainska Pravda's sources named him as Andrii Osipov. "Mexican" is a Russian citizen described as leader of the transnational Khimprom drug cartel. "Price" is allegedly one of the heads of the National Police Strategic Investigations Department. "Consultant" is another police officer. "Akim" is an SBU major general. The officials behind "Price", "Consultant" and "Akim" have not been publicly identified.
Searches, a reported detention and three official responses
Media reports citing sources named three senior SBU officials as the subjects of the searches:
- Anton Kravchuk, head of the SBU Main Directorate of Internal Security, whose premises were searched on 4 November, according to Ukrainska Pravda sources.
- Oleksandr Kovalchuk, first deputy head of the "D" Main Directorate.
- Serhii Duka, first deputy head of the SBU Department for the Protection of National Statehood.
NABU did not name the official who threatened to use a firearm. Ukrainska Pravda, citing unnamed sources, identified him as Duka. Interfax and UA.News noted media reports that it was Duka's security detail.
On the evening of 4 November Ukrainska Pravda, citing law enforcement sources, reported that NABU had detained Duka. Babel, NV and Interfax repeated the report. Hromadske noted that NABU had not publicly confirmed the detention. Babel, also citing law enforcement sources, said the detainees included Volodymyr Tsenov, acting head of the Strategic Investigations Department.
The institutions responded in different ways:
- SBU. It said its chief, Oleksandr Poklad (Reuters calls him acting head), dismissed two high-ranking officers who "have become persons of interest" in the investigation. It did not name them. Poklad said the service expects a "transparent, objective and impartial investigation".
- National Police. It said it suspended the officers concerned for the duration of an internal investigation, and urged everyone to refrain from "premature conclusions".
- PGO. Reuters reported that it said it was ready to cooperate but unaware of illegal activities by the employees implicated.
Whether fast personnel action signals accountability or damage limitation is a question the available record does not settle.
Observers are reading: how the alleged protection model and the 2025 attacks on NABU fit together, and why that reading remains an untested inference.
Become an Observer, it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.
The most concrete allegations
Three episodes in the investigators' materials stand out. Each is an allegation, and none is proven.
Recordings released by NABU capture a suspect proposing to throw acid on Denys Bihus, founder of the investigative outlet Bihus.Info, to make him "unpresentable". Other options discussed included bribing journalists, threats, and luring him abroad under a fictitious exhibition. One member said it would be better not to touch Bihus because of the resonance. Hromadske reported that investigators have not said any such attack took place.
Babel reports that the group allegedly used an SBU employee's account to access "Kyiv Safe City" cameras. In July 2026 a man was attacked near a gym in central Kyiv. Three men in tactical clothing had followed him for weeks, and the third struck him with a metal pipe. "Consultant" allegedly assured the group that no one planned to intercept the attackers, and helped them leave the region.
Suspects allegedly discussed paying $500,000 to a government minister and $200,000 to an intermediary to prevent regulatory changes that could threaten the operation, Hromadske reported. NABU said the plan was not carried out. The minister is not named, and no wrongdoing by any minister is alleged.
Where Carthage began
NABU and SAPO unveiled Operation Carthage in September, as a network allegedly protecting fraudulent call centres. On 5 September they announced that five people were under suspicion in a group headed by a senior PGO official, and Ukrainska Pravda, citing its sources, reported that Serhii Kropyva had been detained. Interfax reported that, according to NABU and SAPO, they laundered over UAH 42 million through real estate, jewellery and deposits into relatives' accounts. Kropyva was remanded in custody on 6 September. On 30 October the High Anti-Corruption Court extended the detention of three suspects by two months, NV reported.
On 7 September Prosecutor General Ruslan Kravchenko announced his resignation. He left Ukraine on 14 September, saying he was on official business, and the Verkhovna Rada approved his resignation on 15 September with 317 votes. Reuters reported that the probe forced his resignation after authorities accused a subordinate of helping run the ring, and that he was not charged with a crime. Jordan News reported that he denied wrongdoing.
On 4 November Kravchenko accused NABU of "political revenge", Hromadske reported. He claimed the SBU units involved in the searches had previously investigated criminal cases concerning NABU Director Semen Kryvonos and people close to SAPO chief Oleksandr Klymenko. Hromadske presented this without verification. NABU's case rests on court-authorised searches and recorded material, which has not been tested in court either.
Observers are reading: how the two readings of Carthage, accountability and rot, play in EU accession and donor politics, and the Operation Midas link.
Become an Observer, it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.
Observers are reading: why the alleged Khimprom and FSB link raises a counterintelligence question for Ukraine's partners, and three scenarios with indicators.
Become an Observer, it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.
What is not yet known
Reports available on 5 November described no notice of suspicion, no court hearing for Duka and no public comment from President Zelenskyy. Hromadske noted that NABU has not publicly identified all suspects or disclosed all alleged bribe amounts. NABU said it would release more detail later (Liga). Duka's reported detention was still unconfirmed by NABU in the statements Hromadske reviewed.
Six developments will show which way the case is moving:
- Whether NABU formally confirms the detentions and names its suspects.
- Whether the officials behind the codenames are publicly identified.
- Whether the SBU's dismissals are followed by cooperation or by friction.
- How the High Anti-Corruption Court handles custody and bail.
- Whether the partner-country investigations Poklad referred to materialise.
- How the Kropyva custody timeline develops.
For Brussels the underlying question is institutional. Whether Ukraine's anti-corruption bodies can investigate the security service while it fights a war will be answered in court filings, not statements. Until then the allegations remain allegations, and the same is true of the counter-claims.
Become an Observer (it's free) to unlock direct links to all sources used in this article.
We believe you deserve to verify everything we write. That's why we meticulously document every source.
