At 10:30 local time on Friday 5 June 2026, residents near the Romanian port of Constanța, on the country’s Black Sea coast, were doubtless startled by the explosion of an explosive-laden uncrewed surface vessel (USV). USVs are routinely deployed by Ukraine’s Main Directorate of Intelligence (GUR) as part of an ongoing campaign against Russian naval activity and shipping. On the same day as the explosion, the Ukrainian government admitted that the weapon did belong to their forces, and blamed Russian electronic warfare (EW) for losing control of the USV.

The craft in question most closely appears to resemble the Nordex ‘Seawolf’ series from Ukrainian company Nordex, one of the more recent designs to enter Ukraine’s arsenal. The ‘Seawolf’ series has also been offered by Polish company Ekskalibur, making the origin of the exact model that exploded in Constanța difficult to confirm.

The USV exploded dramatically although caused no loss of life. There is no suggestion that Ukraine deliberately targeted Constanța, nor would it have any reason for such an action against an allied country. Instead, it appears the vehicle’s control system may have been compromised, most likely by Russian forces and/or intelligence operatives. It appears the USV was deliberately driven into the port and detonated.

Assuming that the explosion was the result of nefarious action, how might a hostile actor have taken control of the USV and then driven it into the port? Several actions would have needed to occur for this to be successful: First, anyone wishing to control the USV would need to somehow gain access to the craft’s control system. Open sources note that many of Ukraine’s USVs, including the ‘Seawolf’ series, navigate via a human controller commanding the USV and/or via a conventional or Satellite Communications (SATCOM) radio link – typically Starlink.

Alternatively, the USV can navigate using a global navigation satellite system (GNSS) positioning, navigation and timing (PNT) signal receiver and/or by employing an inertial navigation system (INS). The latter system may not be dependent on an external radio frequency (RF) source, like a GNSS PNT receiver during the voyage, although it may depend on receiving an initial position fix via the GNSS PNT receiver at the start of its journey.

Anyone wishing to gain access to the USV using conventional radio communications would first need to ascertain the frequencies that the craft’s radios use. This could be determined by through the analysis of previous signals captured by EW cadres confirmed as providing the link between the USV and its operator. Likewise, any SATCOM signals and frequencies used by the Seawolf would need to be identified. Any attempt to gain control of the USV using conventional radio signals would have to occur within a line-of-sight (LOS) range between the craft and the person seeking to gain control. On a calm sea, this LOS range would be circa 5.8 km (3 nautical miles).

It therefore maybe more practical to gain access via a SATCOM signal. Warsight understands that the Seawolf can use the Starlink SATCOM system to connect the craft to her controller. Russia is banned from using Starlink within the country, and in the parts of Ukraine it currently occupies. Starlink satellites are programmed not to send or receive traffic as they pass over these territories. Instead, Russian EW cadres could either use captured Ukrainian Starlink terminals, or terminals illegally purchased on the black market and falsely registered as Ukrainian.

Since February 2026, Starlink terminals in Ukraine must be registered with the government to function, following an agreement between the latter and Starlink’s owner SpaceX. Starlink geofencing would presumably mean a USV cannot be controlled from Russia or from Russian-occupied territory in Ukraine. Nonetheless, it is possible that the terminal could be used illicitly in a third country, or perhaps from a vessel on the high seas that might be part of Russia’s ‘ghost fleet’ of merchant vessels used for sanctions violations.

Comms protocols

Establishing the conventional or SATCOM radio frequencies employed by the USV is only half the battle, assuming the EW system can connect with the craft. The attacker would then need to overcome any Communications/Transmission Security (COMSEC/TRANSEC) protocols used by the USV’s radios. In addition, the boat’s control systems and software will likely have in-built cyber security protocols to frustrate a hacker. The fact that the USV exploded in the harbour of Constanța suggests that whomever had taken control of the Seawolf had the means to detonate her explosive payload remotely.

One alternative to accessing the USV and her control software via her radio link could be to spoof the craft using fake GNSS PNT signals. Employing a GNSS PNT jammer to simply drown out the incoming real signals the weapon relies upon is unlikely to cause the USV to end up in the port where she later exploded. Generally, jamming is used to deflect an uninhabited vehicle away from a potential target. This deflection is achieved by causing the vehicle to either stop in situ or return to its point of origin.

The fact that the USV ended up in Constanța harbour at berth 77/78 seems to suggest that she was deliberately guided to this point and then intentionally detonated. These actions do seem to suggest that something, or someone, could have been capable of deliberately taking control of the craft either via the USV’s reliance on GNSS, or by exploiting her communications and hacking her control systems.

Explosive impact

The USV explosion in Constanța follows several incidents between March and May 2026 in which Ukrainian uncrewed aerial vehicles (UAVs) have entered the airspace of Estonia, Finland, Latvia, Lithuanian and Romania. Some of these aircraft are believed to have entered the airspace of these nations from Russia, indicating that Russian EW cadres may have taken control of them.

These incursions were responsible for damage to a power station chimney in Estonia and an oil storage facility in Latvia. In May, Ukraine apologised to the Greek government after one of her USVs, laden with an estimated 100 kg of explosives, was found in a cave near the island of Lefkada, on Greece’s western Mediterranean coast.

If Russian EW cadres and cyberwarfare experts have succeeded in breaking into Ukrainian uncrewed vehicles and then entering their control software to hijack the vehicles, this could have potentially worrying repercussions, not only for Ukraine, but also its allies.

Firstly, Russian successes in this regard could see Ukrainian capabilities being used against NATO countries neighbouring Ukraine, and potentially further afield in Europe. For example, Ukrainian UAVs like the Fire Point FP-1 have shown themselves capable of achieving ranges of circa 1,600 km (864 nautical miles). Clearly, aircraft with such ranges under hijacked Russian control have the potential to wreak damage across Europe. That said, attributing such an attack to Moscow would become relatively easy for any NATO government targeted thus. Kyiv is hardly likely to deliberately target the very nations providing important materiel, financial and diplomatic support.

By process of easy elimination Moscow becomes the perpetrator. Any future EW-delivered hacking of a Ukrainian uninhabited capability that causes loss of life could be grounds for the aggrieved country to trigger Article Five of the North Atlantic Treaty, NATO’s constitution. This article famously treats an attack on one nation as an attack on all. Moscow could find that in such a situation, a desire to covertly use Ukrainian capabilities against its allies, sees Russia’s political leadership quickly losing control of the narrative, and the wider political consequences.

At the technical level, Ukrainian engineers will be under pressure to enhance the electronic counter-countermeasure (ECCM) attributes of their uncrewed vehicles. To be fair, the electronic counter measure-ECCM battle is never-ending. One side will field electromagnetic capabilities to which the adversary initially has no protection. As a result of war being a powerful science and technology accelerator, the other side will develop countermeasures that will be effective until these too are overcome. Ukrainian engineers have been highly cognisant of this reality.

As they are starting to see Russian EW cadres overcoming their capabilities, Ukrainian experts will already have new technologies and approaches in the offing for which the Russians will have no protection. It is reassuring that Ukraine has performed thousands of attacks on targets in Russia, and targets such as Russian naval assets in the Black Sea, largely unhindered by Russian EW. Success rates indicate that, for the main part, Ukrainian COMSEC/TRANSEC and cyber security ECCMs remain robust.

Perhaps Russia’s success in Constanța may have been a matter of luck in that employed EW and cyberwarfare techniques all worked as desired in the correct sequence. As this article has determined, several barriers must be surmounted if an aggressor is to take hold of an uninhabited system. Nonetheless, the explosion in Constanța is a cause for concern. Ukraine and her allies will be aware that, as bad as the military situation appears to be for Russia, her electronic and cyberwarfare experts can still land a punch.