Mafia in Wrocław: Who was behind the money counterfeiting?

As a result of the services' operation, seven people were detained, including a Russian citizen, a Ukrainian citizen linked to special services, and his wife. The operation, carried out by officers of the Internal Security Agency in April 2026, led to the dismantling of an organized criminal group involved in the production and distribution of counterfeit banknotes. Operational documents indicate that the cash was intended to go directly to the Ukrainian market, which gives the case not only a criminal but also a political dimension.

Detentions in the heart of Lower Silesia: Seven people in the hands of the services

The services struck a location that had served for months as a logistics center for the international operation. The detention of seven people, including key figures with unclear professional status, is the result of months of investigating criminal structures operating in Lower Silesia. The prosecutor's office handling the case is not currently disclosing the full list of names of those detained. Investigators cite the good of the proceedings and the need to protect the identity of individuals who may be linked to a wider intelligence network. The foundation of the charges is mass currency counterfeiting, which was intended to destabilize financial liquidity outside of Poland.

The Ukrainian citizen, detained along with his wife, allegedly used his previous training acquired in security force structures to secure the group's logistics, according to investigators' findings. This combination of technical competence and operational experience is a phenomenon on a national scale. In February 2026, just two months before the aforementioned ABW operation, other services dismantled an international group of cyber-fraudsters in Wrocław, in which 13 people were detained. Investigators examining the counterfeit money case are checking whether both groups used the same transit channels for illegal profits.

Wrocław has recently become an arena for activities by groups with highly specialized profiles. From crime related to prostitution, broken up by the CBŚP and the Border Guard in June 2026, to financial extortion amounting to nearly 20 million PLN by a so-called fake call center – the city has ceased to be merely a local market and has become a transit hub for international criminal groups. Services are increasingly having to face opponents who no longer use primitive methods, but operate based on technology and international intelligence connections. Each of these cases, although handled by different units, sheds light on how much the interests of criminal groups in the Lower Silesian region overlap.

Counterfeit money and an illegal arsenal: What was seized?

During searches at locations linked to the group, ABW officers seized not only printing equipment used for the production of counterfeits but also a substantial arsenal of weapons. Automatic and semi-automatic weapons were found. The presence of such significant weaponry in the context of currency counterfeiting is a signal that the group was prepared for armed confrontation in the event of de-conspiration. The prosecutor's office has not made the technical specifications of the seized weapons public, citing the secrecy of the investigation. It is known, however, that the equipment has been handed over for ballistic testing, which is intended to show whether the weapons were used in other crimes in the country.

The prosecutor's office, although sparing with words, confirms that the seized evidence fully justifies the charges brought. However, the exact amount of counterfeit banknotes seized during the raid has not been made public. The secrecy of the investigation in this regard is understandable – the services fear that some of the counterfeits may have already entered circulation before the moment of the strike. The lack of an official statement on the scale of losses to the banking system is worrying, but this is standard procedure in cases of such high complexity.

In October 2025, 11 members of a criminal group linked to hooligan circles were detained in Jawor. Comparing that case with the current one, a clear qualitative change is visible. While in Jawor we were dealing with classic force-based crime, the group dismantled by the ABW in April 2026 represents a model of "white-collar crime with a gun in hand." This combination of technical competence, ties to special services, and ruthlessness in using a combat arsenal makes this one of the most serious criminal cases in Lower Silesia in recent years. The lack of information about the names of the perpetrators from Jawor or Wrocław suggests that in both cases, the prosecutor's office is aiming to dismantle broader structures, not just to punish the executors.

International character of the group: A threat to security

The involvement of a Russian citizen in a structure whose main goal was the distribution of counterfeit currency to Ukraine raises questions about the true intentions of the perpetrators. The services do not confirm the hypothesis of hybrid activities, but the very fact that the case went to the ABW and not to a standard district prosecutor's office says a lot about the seriousness of the situation. Wrocław, due to its proximity to the border and developed infrastructure, is an ideal place for groups that want to "launder" money from online fraud. Gazeta Wrocławska reported in February 2026 on the dismantling of a group that laundered millions of zlotys from internet scams. The mechanism was simple – they exploited gaps in online banking systems, and the money was transferred through a network of shell companies.

For the public, this remains a dangerous signal. When criminals cease to be just thieves and begin to act as executors of intelligence-related tasks, the line between internal security and international affairs blurs. The actions of the "Shadow Hunters" of the CBŚP, who have been regularly catching wanted persons since September 2024, show that the services have mapped out a network of connections, but the pace at which new groups are emerging is worrying. It has not been stated how many more members of the group remain at large, which suggests that the operation in April 2026 was only the first stage of a broader operation.

What this means for you

Dismantling this group is a won battle, but not the end of the war against organized crime in Lower Silesia. For the average resident of Wrocław, this means, above all, greater vigilance in cash transactions. If automatic weapons and counterfeit money were in the hands of criminals, it means that at any currency exchange point or shop, you could have encountered the result of this gang's work. The lack of specific names of those detained in official prosecutor's office statements makes it difficult to assess whether the case is purely criminal or political in nature.

The greatest threat, however, is not the counterfeit banknotes themselves, but the infiltration of criminal structures by individuals linked to the intelligence services of foreign countries. This makes a criminal offense cease to be an internal police matter and become an element of a wider intelligence game. We will follow the development of events in court, waiting for the first indictment, which will shed more light on the role of the Ukrainian citizen and his Russian accomplice in this operation. For now, we are left to observe how the services cope with the subsequent waves of fraud that are flooding our region. Each subsequent detention, like the one on February 26, 2026, concerning 13 cyber-fraudsters, confirms that Wrocław remains a strategic point on the map of European crime.

Questions and answers

Were the detainees armed at the time of the operation?

Yes, during the raids, an arsenal including automatic and semi-automatic weapons was seized, which confirms that the group was ready to use force in the event of an arrest attempt.

What were the main charges against the detainees?

The main charge is mass money counterfeiting and illegal possession of firearms, with the investigation being developmental and including checking links to foreign entities.

Was the detained Ukrainian citizen a key link?

According to the services' findings, he acted as a coordinator, using his experience from special services to manage the operation, which makes him one of the most important people in the group's structure.

Why did the ABW handle the case and not the police?

The involvement of individuals linked to special services and the international nature of the currency counterfeiting determined the transfer of the case to the Internal Security Agency, which deals with threats to state security.

Were the names of the detained persons released?

No, the prosecutor's office, due to the good of the investigation and the nature of the case, did not disclose the identities of the detainees, limiting itself only to stating their nationality and professional connections.

Did the seized counterfeit money enter circulation?

The prosecutor's office did not give an unequivocal answer to this question, however, intensive activities are being carried out to secure any funds that may have been introduced into circulation before the ABW raid.

What is the legal status of the detainees?

All detainees are in custody, and preventive measures are being applied to those charged, however, details regarding the isolation measures applied have not been made public.

Is the case linked to other frauds in Wrocław?

Investigators are examining possible links to the group of cyber-fraudsters dismantled in February 2026 and other financial crimes, but currently, there is no official information confirming direct connections between these cases.

Were the weapons seized from the criminals used in other crimes?

The seized arsenal has been handed over for ballistic testing, which is intended to answer the question of whether the weapons come from illegal trade and whether they were used in other crimes in Lower Silesia.

Where exactly did the group operate?

The services did not disclose the exact addresses where production was carried out, indicating only that the location served as a logistics center for the international operation in the Wrocław area.