German investigators revealed Tuesday that the August 4 assault on Leipzig/Halle Airport was not a lone-drone incident but a three-vehicle, multi-node operation supported by a purpose-built radio relay station — and that approximately 50 grams (1.76 oz) of hexogen, the military-grade explosive better known internationally as RDX and the base compound of Semtex and C-4, was recovered from a field near the airport ten days after the attack. Chancellor Friedrich Merz, speaking at a coalition summit at Neuhardenberg Castle outside Berlin, told reporters that the government had been “working closely” with security authorities and would “shortly” attribute the attack formally — an announcement that, given existing classified intelligence cited by US defense officials, is expected to name Russian intelligence services. Merz confirmed formal attribution is imminent and added that perpetrators of hybrid attacks against Germany “will pay a price.”

Fifty grams of RDX — the same family of explosive used in the 1988 Lockerbie bombing, albeit in far larger quantities — is enough, placed at a fuel tank or fuselage joint, to destroy a large transport aircraft. The drone slammed into an An-124 wing — a Ukrainian Antonov “Condor” freighter — at 7:30 p.m. local time on August 4, near the aircraft’s fuel tank, before bouncing off and falling to the cargo tarmac without detonating. Its detonator failed — not airport security. The aircraft sat with a drone on its tarmac for approximately four hours before an airport bus driver noticed it. No counter-drone system detected it.

What Investigators Found and When They Found It

On the evening of August 14, forensic teams in the municipality of Kabelsketal, in the state of Saxony-Anhalt, recovered a previously unknown drone tied to the operation. The following day, investigators found the hexogen cache at the same site. The BKA — Germany’s Federal Criminal Police Office — has been working under orders from Federal Prosecutor General Jens Rommel, a classification that signals Berlin treats this as national security, not ordinary crime.

The three-drone timeline, reconstructed from joint reporting by NDR, WDR, and Süddeutsche Zeitung, runs as follows. At approximately 7:20 p.m. on August 4, an explosion occurred in the largely abandoned village of Kursdorf, north of the airport — about ten minutes before the first drone struck the An-124. Traces of that blast were found near an antenna and electronic components taped to a tree: investigators believe this was a drone control relay station, likely self-destructed by its operators after the primary attack failed to detonate. At 7:30 p.m., the first drone — a quadcopter roughly the size of a microwave oven, specially built with no navigation lights and fitted with a 5G router — flew into the wing of the Antonov freighter and fell to the tarmac with its Semtex payload intact. A second object struck a DHL Boeing 757 cargo aircraft approximately 6 kilometers (4 miles) from the airport at around 400 meters (1,312 ft) altitude, as that aircraft diverted around the southern runway closure. The DHL jet landed safely at Hanover with minor nose damage. On August 11, rotor and motor fragments from at least one additional drone were found in surrounding fields.

No arrests have been announced. No confirmed DNA match to a specific individual has been made, despite early reports of a potential link to a 2024 DHL arson case at the same airport.

The Relay Station: What It Changes

Standard counter-drone systems at European airports — radar, radio-frequency scanners, and optical cameras — are calibrated to detect drones that are flying. They scan airspace for RF emissions and moving aerial objects. They are not designed to find a drone that has already landed, and they are not designed to detect a relay node taped to a tree in a village outside the perimeter.

The Kursdorf relay infrastructure represents a specific and documented technique that Russian forces deployed in Ukraine. FPV combat drones typically operate within 5 to 15 kilometers (3 to 9 miles) line-of-sight from their operator. A relay station — whether a ground antenna or an airborne platform — acts as a repeater, extending the effective command-and-control range to hundreds of kilometers. Russian military units have used multi-node ground relay chains to control strike drones from distances exceeding 200 kilometers (124 miles) in Ukraine, documented by open-source intelligence analysts and Ukrainian electronic warfare specialists. The Leipzig relay station was simpler — a fixed antenna at a single site — but it demonstrates that the operators were not standing in a field next to the airport with a handheld controller. They were somewhere beyond the standard perimeter RF detection zone, operating through a purpose-built communication relay.

That distinction matters for European airport security architecture. Detecting the relay node requires expanding the detection perimeter beyond the airport fence — into surrounding villages and rural terrain — a fundamentally different problem from scanning airspace. Germany’s Joint Drone Defence Centre (GDAZ), inaugurated in Berlin in late 2025, and the federal police drone defense unit of approximately 130 specialist officers assigned to airports and sensitive sites, represent real investments. But neither was operationally deployed at Leipzig in a configuration capable of detecting a ground relay in Kursdorf.

RDX at a NATO Airport: What the Explosive Means

Hexogen — the German and European scientific name for RDX — is not commercially available. It is a controlled military explosive, significantly more powerful than TNT, with a detonation velocity of approximately 8,750 meters per second (28,707 feet per second). Semtex, the specific plastic explosive used in the first Leipzig drone, is a compound of RDX and PETN (pentaerythritol tetranitrate), developed in Czechoslovakia and notoriously difficult to detect before taggant-detection requirements were mandated by the International Civil Aviation Organization after the 1988 Lockerbie bombing. C-4, the US military’s standard plastic explosive, is approximately 91% RDX. Fifty grams (1.76 oz) is a small quantity relative to the amounts used to destroy full-size aircraft — the Lockerbie bomb used an estimated 340 to 450 grams (12 to 15.9 oz) of Semtex — but Bild reported that the first Leipzig drone struck the An-124 near its fuel tank. Shaped charges or contact detonations at a fuel tank require far less material than free-air explosions. The presence of RDX-based explosive at a NATO cargo airport, used in a weapon that deliberately targeted the wing of an aircraft loaded the previous day with ammunition for Ukraine, is not a warning shot. It is an attempted aircraft destruction.

The separate 50-gram RDX cache found in the Kabelsketal field — not on any drone — raises an additional question. Security sources cited in Tagesschau reporting suggest “the perpetrators may have had a far larger attack in mind than what has become public.” If the cache represents unused explosive material from this operation, it implies the operation was planned to deploy more explosive capacity than a single Semtex-loaded drone.

Same Airport, Escalating Methods

Leipzig/Halle Airport is not a coincidental target. It is Europe’s third-largest cargo airport, DHL’s primary European hub, and — since Russia’s February 2022 assault destroyed Antonov Airlines’ home base at Hostomel Airport near Kyiv — the operating base for Ukraine’s An-124s. The An-124 can carry approximately 150 metric tons (330,700 lbs) of outsized cargo; no Western aircraft can replicate its payload capacity. Ukraine operates approximately seven civilian An-124s. Four were parked near the drone at the time of the August 4 attack.

In July 2024, an incendiary parcel shipped from Vilnius ignited at the Leipzig DHL hub before being loaded onto a cargo aircraft bound for Britain. Germany’s domestic intelligence service called it a “lucky coincidence” that it had not ignited at altitude. By March 2026, Eurojust confirmed that a joint investigation identified 22 suspects working on behalf of the Russian military intelligence directorate (GRU). Several remain on trial in Vilnius on charges of terrorism and sabotage on behalf of a foreign power.

The operational escalation between the two Leipzig attacks is specific and consequential. The 2024 method used combustible material hidden in consumer goods routed through the civilian postal system — a fire hazard, not a weapon. The 2026 method deployed a specially constructed FPV drone carrying a military plastic explosive, supported by a relay station in a nearby village and two additional drones. The 2024 operation was designed to look like a supply chain accident. The 2026 operation was designed to destroy a specific aircraft.

Germany recorded more than 1,000 suspicious drone flights over sensitive sites in 2025 alone, according to BKA head Holger Münch. A July 2026 report by the International Institute for Strategic Studies identified 144 suspected Russian drone incidents across Europe from 2024 to 2026, characterizing Europe’s collective response as a “strategic failure of allied air defense.” Two days after the August 4 Leipzig incident, drones were spotted over the Mechernich military base in North Rhine-Westphalia — interpreted as continued hybrid pressure on German defense infrastructure.

Germany’s Response: Legislation, Attribution, and a Promise

The August 4 attack arrived at a moment when Germany had already been accelerating its counter-hybrid legislative framework. On February 27, 2026, the Bundestag passed Air Security Act amendments to grant the Bundeswehr authority to intercept, jam, and shoot down drones over German territory — a power the military had previously lacked in domestic airspace. Germany committed over €100 million (approximately $111 million USD) in counter-drone spending for 2025 and 2026, covering jamming systems, net guns, AI-assisted interceptors, and airport radar upgrades.

On August 12, 2026, Merz’s cabinet approved a sweeping 732-page intelligence bill granting the BND (foreign intelligence service) and BfV (domestic counterintelligence) active offensive powers for the first time since World War II — including cyberattack authority, supply-chain sabotage capability, and the right to interfere with hostile drone operations. Interior Minister Alexander Dobrindt explicitly cited “daily drone incidents and sabotage by foreign powers” as justification. The bill has been approved by cabinet; it awaits a parliamentary vote.

Merz’s August 25 statement — that attribution will be announced “shortly” and that perpetrators “will be held accountable” — is the first time the chancellor has publicly committed to a formal attribution timeline rather than a general warning. US defense officials familiar with classified intelligence assessments have already told media outlets that the explosive drones at Leipzig belong to a Russian intelligence service. Germany has not yet made that assessment public. When it does, it will trigger a diplomatic response that both Merz and Dobrindt have indicated will carry real consequences — though precisely what those consequences look like in a hybrid conflict designed to stay below Article 5 threshold remains unspecified.

Was the Attack Designed to Succeed or to Demonstrate?

That question is worth asking — and it does not have a comfortable answer.

A single FPV drone carrying Semtex is not a weapon of mass destruction. If the operation’s purpose were purely demonstrative — to show that Russia can reach the tarmac of a NATO cargo hub, to intimidate logistics operators, to probe security responses — a failed detonation still achieves the goal. The aircraft was struck. The airport was disrupted. The security gap was demonstrated. The message was sent.

But the facts recovered since August 4 complicate the demonstration-only interpretation. Three drones were deployed, not one. A relay station was constructed and positioned, then apparently destroyed to hide evidence. A separate explosive cache was left in a field, unused. The first drone struck the target aircraft near a fuel tank. These are the signatures of an operation designed to succeed and prepared for the possibility of asset loss — not a scripted near-miss. The detonator failure, if investigators confirm it was a component malfunction rather than a deliberate safing decision, was not part of the plan.

The operational difference between a demonstration and a failed assassination of an aircraft is measured by the detonator. At Leipzig, the margin was the width of a hardware component that did not function.

Exchange rate conversions are approximate, based on rates at time of publication.

Frequently Asked Questions

How many drones were involved in the Leipzig Airport attack, and what do investigators now know?

German investigators have confirmed three drones linked to the August 4 operation at Leipzig/Halle Airport. The first, carrying a Semtex plastic explosive payload, struck the wing of a Ukrainian Antonov An-124 freighter near the aircraft’s fuel tank but failed to detonate when its detonator malfunctioned. A second object struck a DHL cargo aircraft approximately 6 kilometers (4 miles) away during its diversion. The third drone was found on August 14 in a field in the municipality of Kabelsketal, west of the airport, accompanied by approximately 50 grams (1.76 oz) of hexogen — the military-grade explosive that is the base compound of both Semtex and C-4. Investigators have also identified a suspected drone control relay station in the abandoned village of Kursdorf, north of the airport, where an explosion was recorded approximately 10 minutes before the first drone struck the aircraft.

What is hexogen (RDX), and how powerful is it?

Hexogen is the German and European scientific name for RDX (Research Department Explosive), a military-grade nitroamine explosive first developed in the early 20th century and widely used in military munitions. It is significantly more powerful than TNT, with a detonation velocity of approximately 8,750 meters per second (28,707 feet per second). RDX is the base compound in several of the world’s most widely deployed military explosives: Semtex (RDX + PETN), C-4 (approximately 91% RDX), and Composition B (60% RDX, 40% TNT). It is not commercially available and its presence at a NATO cargo airport in a device targeting a military aircraft is consistent with state-level supply chain access rather than black market procurement. The 50 grams recovered in the Kabelsketal field is a small quantity relative to the amounts used in mass-casualty bombings, but the amount carried in the first drone is not publicly confirmed; Bild reported the drone struck the An-124 near its fuel tank, where the threshold for catastrophic damage is significantly lower than in a free-air detonation.

What is a drone relay station, and why does the Kursdorf node matter for European airport security?

Standard FPV (first-person view) combat drones operate within approximately 5 to 15 kilometers (3 to 9 miles) of their operator, limited by the radio horizon and terrain. A relay station — whether a fixed ground antenna or an airborne platform — repeats the radio signal between operator and drone, extending the command-and-control range dramatically. Russian forces have used multi-node relay chains to operate FPV strike drones from distances exceeding 200 kilometers (124 miles) in Ukraine. The Kursdorf relay node, found north of Leipzig/Halle Airport, indicates that the Leipzig operation’s operator was not standing in the immediate vicinity of the airport and was therefore outside the standard RF detection footprint that counter-drone systems at civilian airports are designed to monitor. For airport security planners, the relay station reveals that securing the airport perimeter from drone threats is not sufficient — the threat now requires monitoring the surrounding terrain.

What is Germany doing about the attack, and when will attribution be announced?

Germany has been accelerating counter-drone and intelligence legislation since 2025. The Bundestag amended the Air Security Act in February 2026 to grant the Bundeswehr authority to intercept or destroy drones over German territory, and committed over €100 million (approximately $111 million USD) for counter-drone systems. On August 12, 2026, Chancellor Friedrich Merz’s cabinet approved a 732-page intelligence reform bill granting the BND and BfV offensive cyber and sabotage-disruption powers specifically designed to counter hostile drone operations and hybrid attacks. On August 25, Merz stated that the government will “shortly” announce formal attribution for the Leipzig attack. US defense officials have already told media that the drones belong to a Russian intelligence service. A formal German attribution would be one of the strongest diplomatic escalation steps Berlin has taken against Moscow since Russia’s 2022 invasion of Ukraine.