Two men have been convicted of carrying out arson attacks on properties connected to Sir Keir Starmer, acting under the direction of a Russian-speaking online handler who paid them in cryptocurrency for the fires.
Roman Lavrynovych, 22, a Ukrainian national, and Stanislav Carpiuc, 27, from Romania, were found guilty on Monday at the Old Bailey of conspiracy to commit arson. Lavrynovych was also convicted of two counts of arson, reckless as to whether life would be endangered, for fires he set on 11 and 12 May last year. Their co-defendant, Petro Pochynok, 35, also Ukrainian, was acquitted of conspiracy to commit arson. Sentencing for Lavrynovych and Carpiuc is scheduled for Friday.
The attacks took place over three nights in May 2025. On 8 May, a Toyota RAV4 was set alight in Kentish Town. Three days later, a fire was started at the doorway of a residential property in Islington. Then, on 12 May, a house owned by the prime minister in the same north London borough was targeted. The prosecution said the defendants operated under the instructions of a Telegram user who used the pseudonym “El Money” — also known as “Hroshi” in Ukrainian — who communicated in Russian and offered payment in cryptocurrency for the arson.
Prime Minister’s response and wider context
Speaking from the G7 summit in Évian-les-Bains, France, on Wednesday, Sir Keir Starmer said the attack on the house had “clearly impacted and affected my family”. He said the trial demonstrated that the UK is under assault from “bad actors” who seek to “exploit division” and “destabilise our democracy”. The prime minister added that the country is dealing with proxy attacks from Russia “every single day”.
The convictions come amid a period of heightened tension between London and Moscow. On Sunday, British forces intercepted and boarded a sanctioned Russian shadow fleet oil tanker, the Smyrtos, in the English Channel — the first UK-led operation of its kind. On Tuesday, a Russian warship, the Admiral Grigorovich, fired warning shots near a British-flagged pleasure yacht, the Bright Future. The Ministry of Defence said the shots were not aimed at the vessel and were intended to prevent a possible collision. Sir Keir described the incident as “deeply concerning and reckless”.
At the summit, the prime minister announced 70 new sanctions targeting Russia’s “shadow fleet”, military procurement supply chains and illicit finance networks. The UK has now sanctioned more than 600 vessels linked to the shadow fleet, which Moscow uses to circumvent Western restrictions and finance its war in Ukraine.
Sir Keir said the arson attacks needed to be seen in the “broader context” of Russia’s war in Ukraine. “Some of the evidence that came out of trial speaks for itself, but there are wider issues here,” he said. “We see this the whole time.” He accused politicians and other “actors” in the UK of being “more than happy to indulge in tearing our country apart”, and warned of “those from outside our country who are trying to find ways to exploit division in our country to destabilise our democracy”.
The handler: ‘El Money’ and the Russian link
Central to the case was the mysterious online figure known as “El Money”. Counter Terrorism Policing London, which led the investigation, said it had uncovered extensive communication between the defendants and the handler, as well as evidence of reconnaissance, but had not proven the handler’s identity or found direct evidence of a state-backed threat.
Lavrynovych’s phone contained more than 320 messages with “El Money” dating back to September 2024. The court heard that the handler initially recruited Lavrynovych through Telegram for low-level tasks such as putting up posters and spraying graffiti, before moving him on to arson. The handler offered £3,000 in cryptocurrency to carry out the fires, film them, and ensure they were reported in the news. Lavrynovych told the court he needed the money for his father’s medical treatment.
Investigations by the BBC and the Financial Times have sought to trace “El Money”. The FT, citing Telegram archives, cryptocurrency wallets, court evidence and interviews with western officials, established that the handler was located in Russia and was closely aligned with NoName057(16), a pro-Kremlin hacktivist group that the US has called a Russian “state-sanctioned project”. That group has been active since March 2022, primarily using distributed denial-of-service attacks to disrupt entities deemed anti-Russian, targeting government agencies, media and private companies across Europe, the US and the UK.
The BBC has identified evidence suggesting that “El Money” may be Evgeny Lyukshin, a 23-year-old Russian diplomat with links to senior levels of power in Moscow. The Russian embassy has denied any involvement. The defence team also pointed to the shadowy nature of the handler. “There’s one winner in this case: the anonymous devil who manipulated, used and won,” James Scobie KC, representing Lavrynovych, told the court in closing remarks. Saying little was known about him, he added: “But Russia – let’s call it out – Russia are interested in what this country does in support of Ukraine. This person, or people, spoke excellent Russian.”
Disinformation and far-right amplification
The attacks have also been accompanied by disinformation campaigns. Some security sources said an outlandish and false theory that emerged after the attack — that the defendants were aggrieved sex workers who torched Starmer’s home because they had not been paid — could have been created by far-right figures in the UK and amplified by hostile Russian agents. The BBC reported that Russia-based accounts spread the unfounded claims, which were further amplified by figures such as Tommy Robinson.
Asked whether he was concerned that figures on the far right were acting, inadvertently or otherwise, as de-facto Russian agents, Sir Keir said: “There are many actors who want to divide our country and to cause conflict in our country.” He added: “We need to be really clear in relation to that and we need to fight it at every twist and every turn.”
Lavrynovych was arrested on 13 May 2025, a day after the final fire. Carpiuc was detained at Luton Airport on 17 May. Their trial began in April 2026 at the Old Bailey. The pair are due to return to court on Friday to learn their sentences.
