“Our message to anyone who might be approached in this way, or thinking about doing similar, is to think again. As we’ve seen here, you will not get paid as you are promised, you will be identified and brought to justice, and the only thing you will be left with is facing the prospect of a lengthy jail sentence.”
That warning, issued by the Metropolitan Police, comes after three arson attacks on properties linked to Prime Minister Sir Keir Starmer were brought before the courts. The cases, sentenced on 19 June 2026, involved two men who were caught, identified and jailed — and a third who was acquitted — after a series of fires in north London that investigators say were orchestrated by an anonymous Russian-speaking handler using the pseudonym “El Money” on the Telegram messaging app.
The most serious sentence fell to Roman Lavrynovych, a 22-year-old Ukrainian national, who was found guilty of two counts of committing arson being reckless as to whether life was endangered, and one count of conspiracy to commit arson. He was jailed for seven years. A second man, Stanislav Carpiuc, a 27-year-old Romanian citizen born in Ukraine, was convicted of conspiracy to commit arson and sentenced to two years in prison. A 35-year-old Ukrainian man, Petro Pochynok, was acquitted of conspiracy to commit arson.
How the attacks unfolded
The first fire took place on 8 May 2025, when a Toyota Rav4 — a vehicle previously owned by Sir Keir Starmer — was set ablaze in Kentish Town, north London. Three days later, on 11 May, a fire was started at the front door of a property in Islington that the Prime Minister had previously managed through a company of which he was a director and shareholder. The following day, 12 May, a fire broke out at the front door of a house in Kentish Town that Starmer owned and rented to his sister-in-law and her family. She reported struggling to breathe because of the smoke. No injuries were caused by any of the attacks, but the distress was significant.
Lavrynovych was described by the judge as a “useful idiot” and a “fool” who had been manipulated by his handler. The court heard that he had “significantly low-level intellectual functioning” and lacked strong principles, making him vulnerable to direction. He was given instructions in Russian and Ukrainian by “El Money”, including detailed advice on mixing flammable liquids. The attacks were to be filmed and the footage ensured it gained media attention. In return, Lavrynovych was promised payment in cryptocurrency — payment that never arrived.
Carpiuc acted as a middleman, tasked with facilitating the promised cryptocurrency payment and recruiting someone to record the fires. He was arrested at an airport, indicating he had been attempting to leave the country.
The evidence that caught them
Police recovered a petrol can bearing Lavrynovych’s DNA, and CCTV footage showed him purchasing white spirit before the attacks. His phone data revealed extensive communication with “El Money” about recruitment, instructions and the promised payment. Evidence also showed that Lavrynovych had conducted reconnaissance and later returned to photograph the damage, confirming the offences were planned.
The Metropolitan Police said the case highlighted a recurring trend: crimes directed by anonymous online accounts that promise payment. Detective Cmdr. Dominic Murphy, former head of the counterterrorism team at the Met, stated that “El Money” likely operates from Russia and employs methods similar to those used by Russian intelligence services. While no definitive evidence was presented in court linking the handler directly to the Russian state, the use of Russian language and the operational style were considered indicative. Western officials have said Russia is running a sabotage campaign against European countries that support Ukraine, and the plot was seen as fitting that pattern.
The case has also been linked to “Direct Action UK”, a group suspected of being a front for Russian state-linked operatives involved in hybrid warfare. Prime Minister Starmer described the attacks as “an attack on democracy” by “bad actors” seeking to “exploit division” and “destabilise democracy”. The prosecution told the court, however, that it did not need to prove any political or ideological motivation, nor that the defendants knew the properties belonged to the Prime Minister.
Justice and the deeper pattern
Lavrynovych’s phone also contained evidence of other crimes he had committed for money, including painting car windshields and putting up anti-Islam posters. Those acts are the subject of further investigation by police. Shortly after his arrest, a false rumour circulated online claiming the arsonists were male prostitutes seeking revenge — a claim that was amplified by Russian media and conspiracy theorists.
The case was initially handled by Counter Terrorism Policing (CTP) London, reflecting the national security dimension of the plot. In delivering the sentences, the judge did not hold back. Lavrynovych and Carpiuc were told they would face the full consequences of their actions: prison terms that would separate them from their liberty, and no payment for the work they had done. As the police message made clear, those who are lured by promises of cryptocurrency and instructions from anonymous handlers will be identified, prosecuted, and left with nothing but a lengthy jail sentence.
