Digital Crime Transformation
Sabotage Has a Price Floor: Remote Coercive Tasking in Wartime Ukraine
Payments for remotely tasked sabotage are routinely read as evidence of scale — they are better read as a calibration instrument that tells you when a reported transaction was not a purchase at all.
Abstract
Claims about coercion markets are ordinarily made without prices. Analysts describe recruitment channels, organisational forms and jurisdictional cover, then assert that something market-like exists. This paper reconstructs what the open Ukrainian record actually supports on price: not a price list, but recurring price points for standardised tasks and a floor below which operationally significant work is not purchased.
The floor is the useful part. It converts price from a descriptive detail into a test. A payment below the floor does not describe cheap coercion; it describes something that is not a purchase — a mischaracterised task, an incomplete account of the consideration, or a transaction conducted on some basis other than an arm’s-length one.
The paper then argues that recurring prices and a stable transaction template do not establish industrialisation. Remotely tasked sabotage in Ukraine exhibits an elastic supply of untrained, unselected and disposable executors, which is the opposite of the recruitment-and-training architecture documented in industrialised scam operations. The distinction determines which interventions have leverage.
Finally, the benchmark is applied. In July 2026 the price ladder was used to test the official account of Ukraine’s Starlink registration prosecutions, and to predict where a serious operation at scale would have to sit. What followed is examined as confirmation of a structural expectation — with an explicit limit on what such confirmation can establish.
1. Introduction
In the Ukrainian cases documented between 2024 and 2026, the arson of a railway relay cabinet was purchased for between two hundred and one thousand dollars. That figure is more analytically useful than any narrative account of who ordered the task or why.
The misclassification is this. Prices in coercion cases are habitually treated as colour — an incidental detail illustrating how cheap violence has become. They are better treated as instrumentation. A price encodes what class of task was purchased, what kind of person the buyer expected to attract, and whether the executor was treated as a contractor or as a consumable. Above all, a price encodes when a reported transaction cannot have been what it was described as.
The argument proceeds in six stages. Section 2 establishes what the open record supports and what it does not. Section 3 sets out the structure of the resulting ladder. Section 4 describes the transaction template that makes the tasks repeatable. Section 5 argues that this template falls short of industrialisation, and that the shortfall is load-bearing for policy. Section 6 applies the benchmark to a case outside the sabotage domain. Section 7 concludes.
2. From Anecdote to Benchmark: What Prices Establish
2.1 The Definitional Problem
The literature on distributed coercion establishes that coercive capability has become modular, networked and purchasable. Purchasability implies a price. But the evidence usually offered for market formation is organisational rather than economic: the existence of brokers, of tasking channels, of repeat offending. None of those distinguishes a market from a series of unrelated arrangements that happen to look alike.
Prices do. Comparable figures for comparable tasks, recurring across regions and across years, are what separate a pattern of purchasing from a coincidence of incidents.
2.2 The Corpus and Its Limits
This analysis draws on 37 documented cases from 2024 to 2026 in which a physical coercive task was assigned remotely — typically via Telegram — to an executor inside Ukraine, with payment offered on completion.
Three limitations apply throughout, and none of them is incidental.
First, this is a corpus of prosecuted cases. It reflects what investigators detected, charged and brought to judgment. Successful operations, abandoned ones and unpaid ones are systematically under-represented.
Second, the figures are offers and settlements as recorded in proceedings, not a market survey. Some were paid, some partially, some never.
Third, where the word market is used below, it applies to the product — standardised tasks at recurring prices — and not to the labour relation. The executor at the base of the structure is frequently not a contracting party with exit rights.
2.3 What the Open Record Supports
The record does not yield a price list. It yields two things, and they are sufficient.
Recurring price points for like tasks, comparable across regions and across years. And a floor: below roughly two hundred dollars, the corpus does not show operationally significant tasks being purchased.
| Task | Documented figure | Evidentiary basis |
|---|---|---|
| Arson of a railway relay cabinet | $200 – $1,000 | Verdicts in Khmelnytskyi ($200) and Mykolaiv ($1,000) |
| Arson of a serviceman’s vehicle | ~$1,000 (official average) | Deputy head of the National Police Main Investigation Department, responding to a press query from Graty |
| Killing of a serviceman | from $5,000 | Offer recorded by Slidstvo.Info in a controlled journalistic inquiry; cited as a documented offer, not as a completed transaction |
| Political assassination | tens of thousands | Distinct segment; not continuous with the tiers above |
Table 1. Documented price points for remotely tasked coercion in Ukraine, 2024–2026.
3. The Structure of the Ladder
3.1 Compression at the Bottom, Discontinuity at the Top
Two structural features matter more than the individual figures.
The band is compressed at the bottom. Infrastructure sabotage and arson against individuals occupy a narrow range around the low four figures, despite differing sharply in target, risk and consequence. Price is tracking the cost of obtaining a disposable executor, not the value of the effect delivered.
The band is discontinuous at the top. Political assassination is not the highest rung of the same ladder but a separate segment, with different buyers, different vetting and different operational security. Treating the two as a single continuum overstates what the cheap tier can reach.
3.2 The Currency Is Not Only Money
In June 2026, the Kyiv City Prosecutor’s Office described a case in which the executors of a bombing were promised something other than cash: unchecked passage into Russia, presented to them as an amnesty programme.
This is not a curiosity. For a deserter, a draft evader, or anyone whose principal problem is exposure to the state, removal from harm’s way is compensation that no dollar figure captures. It is also cheap for the buyer, who is promising a future action in a jurisdiction the executor cannot verify — and who frequently does not honour it.
Any estimate of what coercion costs in a conflict zone that counts only monetary payments will understate the supply of executors, because it misses the segment for whom money was never the binding offer.
4. The Transaction Template
The corpus shows a consistent transaction template rather than a series of improvisations:
- Recruitment through open channels. Telegram advertisements framed as easy earnings, addressed to a general audience rather than to a criminal milieu.
- Advances and staged payment. Partial payment before the task, the balance on delivery.
- Proof of work. Photographs, video or geolocation submitted before final settlement.
- Non-payment as a normal outcome. Executors are frequently not paid. The structure absorbs this easily: replacements are elastic in supply and the executor has no enforcement mechanism.
- Recruitment of acquaintances by executors. Individuals brought in by a handler are instructed to bring in others, converting a single contact into a small local network.
What is being reused here is not a product but a transaction architecture — anonymous tasking, staged settlement, verification by evidence of delivery, disposable executors — inherited from digital drug distribution rather than invented for sabotage.
5. Recurring Service, Not Industry
5.1 What Industrialisation Requires
It is tempting to read recurring prices and a stable template as evidence of industrialisation. On the present record, that reading is not supported.
Industrialisation means something specific in this research: a durable recruitment pipeline, selection, training, script production, quality control, personnel replacement, and the capacity to reproduce operational capability after losses. Scam compounds meet that description. Remotely tasked sabotage in Ukraine does not.
Executors are recruited off open channels with no evident selection. They are not trained. They are frequently detained on a first attempt, which is consistent with the absence of any preparation at all. They are not replaced within a structure so much as re-sourced from an undifferentiated pool. There is no observable investment in the executor — which is precisely why the executor is cheap.
5.2 Why the Distinction Determines Leverage
| Dimension | Recurring service | Industrialised infrastructure |
|---|---|---|
| Executor supply | Undifferentiated pool, no selection | Recruitment pipeline with selection and training |
| Investment per operator | None observable | Substantial: scripts, protocols, quality control |
| Response to enforcement | Individual arrests reduce nothing; the pool is unaffected | Node removal reduces nothing; capacity is reproduced |
| Response to cost increases | Purchasing becomes harder at the margin | Absorbed as a cost of goods |
| Where leverage exists | The price of assembling an effect | The infrastructure that reproduces capability |
Table 2. Recurring service and industrialised infrastructure compared by intervention leverage.
Both structures are resilient, but for different reasons, and they yield to different instruments. Raising the cost of purchasing tasks bites on a recurring service. It does not bite on an industrialised system, which absorbs cost increases and continues — the pattern documented in cross-border financial coercion targeting British and Russian retail banking customers (Turkhanov and Khimich, 2026).
6. The Benchmark Applied
6.1 The Below-Floor Signal
Consider the ordinary commercial intuition about counterfeits. When a genuine article is offered far below its established market price, the price is not a bargain but evidence about the transaction: something in the description is wrong. Nobody treats the low figure as a datum about the value of the goods.
The same move is available here, and it is what a floor is for. Once the floor is established, any reported payment beneath it becomes a question rather than a fact about cheapness. If a task is described as operationally significant and the reported payment sits under the floor, one of three things is true: the task was not what it was described as, the payment was not the whole consideration, or the transaction was not an arm’s-length purchase.
6.2 The Prediction
The first published application of this test concerned Ukraine’s Starlink access-control regime. In an analysis published on 11 July 2026, the reported payments in the first eight publicly described registration cases — thirty to two hundred dollars, according to the SBU — were measured against the ladder above. Those figures sat at or below the floor for the least demanding tasks in the corpus, while the registrations were simultaneously described as enabling access to infrastructure of exceptional operational significance.
The price analysis did not invalidate the cases. It invalidated their use as evidence that the principal Russian registration channel had been identified and suppressed.
It also produced a structural expectation, published on the same date. A serious operation at scale would have to look different: organised access to identity data and documents, repeated passage through registration procedures, and intermediaries or insiders capable of processing terminals in volume rather than one marginal recruit at a time.
Two SBU releases, on 24 and 25 July 2026, described operations of that shape: one covering 76 terminals, the other more than 1,000. Both, according to the releases, ran through the registration procedure itself rather than through the recruitment of marginal individuals one terminal at a time. The mechanics of those two operations are examined separately.
The subsequent case study, When the Whitelist Became the Attack Surface: Ukraine’s Starlink Access-Control Crisis, February–July 2026, traces how the predicted scaling problem later became visible in public enforcement output.
6.3 What Confirmation Does and Does Not Establish
One limit must be stated plainly, because the alternative is to repeat the error the benchmark was built to catch.
What changed in late July is the public output of an enforcement agency, not a measured change in the underlying activity. A structural expectation was matched by what the SBU chose to publish. That is meaningful — the released material sits in the layer the analysis identified, not the layer the earlier cases occupied — but it does not establish that the bulk layer came into existence in July, nor that it did not exist throughout.
Nor do the releases demonstrate use. They describe registration and verification. They do not present traffic, captured devices, or any link between a registered terminal and an operation. Accepting the reported scale of registrations is not the same as accepting a claim about a thousand terminals in operational service, and the gap between those two propositions is four digits wide.
7. Conclusion
First, the open Ukrainian record supports recurring price points for standardised coercive tasks and a floor below which operationally significant work is not purchased. It does not support a price list, and the stronger claim is not needed.
Second, the ladder is compressed at the bottom and discontinuous at the top, because price tracks the cost of obtaining a disposable executor rather than the value of the effect delivered.
Third, the currency includes non-monetary consideration. Any cost estimate that counts only money will understate the supply of executors.
Fourth, recurring prices and a stable transaction template do not establish industrialisation. What exists is an elastic supply of untrained and disposable labour meeting a supply of standardised tasks — a recurring service, and the distinction determines which interventions have leverage.
Fifth, the floor is portable. Its value lies outside the sabotage domain: it is an instrument for testing published accounts of coercion in any field where a figure is reported alongside a claim about significance.
None of this makes the executors at the base of the structure less consequential. It makes them less expensive to replace, which is a different and more troubling fact.
A payment below the floor does not describe cheap coercion. It describes something that is not a purchase.
References
Khimich, R. (2021). Theses on Personal Safety in the Digital Realm.
Khimich, R. (2026a). The Digital Transit of Coercion: Industrialization, Distribution, and the Emerging Architecture of Remote Violence. Working Paper. https://doi.org/10.5281/zenodo.20023495
Khimich, R. (2026b). Mitigation, Deterrence, Suppression: A Policy Typology for Industrialized Cross-Border Coercion. Working Paper. https://doi.org/10.5281/zenodo.20023938
Khimich, R. (2026c, 11 July). Starlink Was Blocked. Russian Access Was Not. https://romankhimich.substack.com/p/starlink-was-blocked-russian-access
Turkhanov, A. and Khimich, R. (2026). Parasites on Trust: Cross-Border Industrial Coercion and the Misallocation of Liability in British Banking. Working Paper.
Kyiv City Prosecutor’s Office (2026, 22 June). Statement on the bombing near the Kyiv Polytechnic Institute.
Security Service of Ukraine (2026, 24 July). Release on the illegal registration of Starlink terminals. https://ssu.gov.ua/novyny/sbu-vykryla-dvokh-poplichnykiv-rf-yaki-aktyvuvaly-dlia-rashystiv-ponad-70-terminaliv-starlink
Security Service of Ukraine (2026, 25 July). Release on the illegal verification of Starlink terminals. https://ssu.gov.ua/novyny/sbu-zatrymala-u-dnipri-ahenta-rf-yakyi-aktyvuvav-dlia-voroha-ponad-1000-system-starlink