A drone packed with plastic explosives was found on the tarmac at Leipzig/Halle Airport on Tuesday night, parked within feet of two Ukrainian cargo planes, and German prosecutors say a faulty detonator is all that stopped a mass-casualty attack. Federal investigators have since opened a counterterrorism case, and blame has quickly centred on Russia, which Berlin has long accused of running sabotage operations across Europe.
Airport staff spotted the machine shortly before midnight, hovering low between two Antonov An-124 freighters among the largest cargo aircraft ever built. The device carried a fist-sized block of what investigators believe was semtex, a powerful military explosive, wired to a remote detonator. That ignition system failed, German authorities said, which may have prevented a disaster. The airport sits about 20 kilometres from the centre of Leipzig, a city of more than 600,000 people, and its two 3,600-metre runways and round-the-clock cargo halls make it one of the most heavily scheduled freight sites in Europe.
The Guardian reported that a classified police document, quoted by the public broadcasters WDR and NDR and the Süddeutsche newspaper, said one of the Ukrainian aircraft parked next to the drone was carrying a military load, including a tank of jet fuel, that had been flown in from France earlier that evening and was meant to move onward.
A cargo plane, then a second drone
The discovery forced the airport to halt air traffic and scramble emergency teams. A DHL cargo plane flying in from Marseille had to abort its landing and climb away, and during that go-around the flight crew reported hitting something in the air. Police now believe it struck a second drone. The aircraft diverted to Hanover, about 160 miles northwest, carrying what an official report lists as hazardous goods, and landed with minor damage.
Germany's federal prosecutor took over the case from state prosecutors on Thursday. In a statement, the office called the episode "a serious attack on the transportation and logistics infrastructure in Germany" and said there was enough evidence to conclude that an explosion was deliberately attempted, as ABC News reported. The investigation has been handed to counterterrorism officers who handle threats to national security.
The airport worker who found the first drone said it was hovering low near the ground between the two Antonov tails. German media reported that a small camera mounted on the machine had been filming the approach, and security footage suggests the drone sat on the site for hours before it was noticed. Its cylindrical detonator appeared to have been assembled by hand.
Why Leipzig keeps getting targeted
Leipzig/Halle is Germany's largest cargo hub after Frankfurt and among Europe's busiest freight airports, moving roughly 1.4 million tonnes a year. DHL relocated its main European air network there in 2008, and today about 7,000 DHL workers shift around 2,500 tonnes through the airport every day across some 23,600 flight movements a year. Lufthansa Cargo and Amazon also use the site.
Beyond civilian freight, the airport is a central military and NATO logistics point. It hosts the bulk of SALIS, the Strategic Airlift International Solution, which flies equipment to reinforce the alliance's eastern flank, and it is the main base for Antonov Logistics SALIS, a joint aircraft provider that maintains and operates the An-124-100 fleet used to move allied cargo.
Since early 2022 the airport has also served as an alternate route for material supporting Ukraine, according to publicly available records. German officials said their own armed forces were not running military transport from the site at the time of the incident, but the facility's role in allied logistics is well documented.
Who is being blamed
Berlin has stopped short of naming Moscow outright. Interior Minister Alexander Dobrindt said investigators were treating the episode as part of a "professional hybrid threat scenario" with a focus on "foreign powers," but has not asserted the Kremlin's hand directly. Germany's federal prosecutor said it suspected a political target, though it declined to attribute the act.
The political pressure is rising all the same. Roderich Kiesewetter, a member of parliament's intelligence committee, told German media he viewed the Leipzig incident as "a targeted hybrid attack, in other words an attempted act of terrorism, orchestrated by Russia." The Russian embassy in Berlin did not respond to the Guardian's request for comment.
The events echo an earlier scare. In July 2024 a firebomb sent through DHL's Leipzig sorting hub went off on the ground, and a second parcel started a fire in a warehouse in Birmingham, England. A Europe-wide inquiry later found dozens of suspects in Lithuania and Poland, workers who officers believed had been recruited by Russian intelligence to test and send devices, The Guardian reported. Investigators are expected to look for common signatures between that campaign and this week's drone.
German airports have been on high alert for months. Police have logged a cluster of disputed drone overflights at military facilities, energy terminals, seaports, and logistics firms, and they attribute many of them to a persistent program of surveillance they say Moscow runs against critical civilian infrastructure.
The lessons for drone defense
The Leipzig episode is a sharp reminder that low-cost quadcopters have become cheap and difficult weapons. The airport's anti-drone sensor equipment did not even register the craft, despite the site being classed as critical infrastructure, and investigators believe the machine had been changed to slip under detection, flown low and slow to avoid a radar lock.
The gap between an unassuming commercial drone and a viable attack has narrowed sharply. German civilian airports sit in a different legal and practical position from military bases, and a craft that avoids radar can glide close to a packed apron before anyone is the wiser. Sabotage networks, in that reading, want to test whether a state can land a drone weapon on a crowded civilian strip without any agency tracking it, an assessment set out in ABC News' explainer on how and why Leipzig became a target.
The fact that the device sat undiscovered for hours, next to aircraft carrying high-value cargo, will push security agencies to reassess how surveillance is placed around hubs like Leipzig.
The plot nearly worked, and it took a flawed switch to stop it. Investigators are now rebuilding the machine's signal path, looking for the radio frequencies it used, the serial markers on its motors, and whether it carried any software that could point back to who assembled it. The detonator that failed was wired by hand, according to German media, which means whoever built it had enough skill to attach a charge but trusted a component that did not hold together. Air traffic has returned to normal, and Leipzig's southern runway reopened Thursday, but the political conversation has barely started.
For those tracking the war in Europe, the message is a warning. A drone that can carry a fist-sized charge of plastic explosive to a row of parked freighters, evade detection, and wait for hours turns a busy cargo airport into a potential bomb site whenever the defence systems happen to fail. Leipzig escaped by the smallest margin, and the next airport might not.
Read more about autonomous and unmanned system news in our robotics and drones coverage, and the defensive shifts across AI and technology.