Click to see the full-size image
For four years, Brussels has presented the arms pipeline to Ukraine as an investment in European security. But every long war leaves a second economy behind it: weapons that disappear from inventories, explosives that leave depots, brokers who learn the routes, and trained men who know that military hardware is worth more on the black market than on a ledger.
The danger is not a column of stolen tanks rolling toward Berlin. It is a rifle in a drug trafficker’s car near Marbella, a grenade hidden inside commercial cargo, a drone purchased through an encrypted chat, and a customs declaration that calls weapons “scrap metal.”
The Arsenal That Stays Behind
The latest figures from Ukraine show the scale of the coming problem.
According to Ukrainian Interior Ministry data cited by Il Fatto Quotidiano, 780,465 weapons and munitions have been recorded as lost or stolen in Ukraine since 2022. Of these, 149,000 vanished in the first five months of 2026 alone. The largest concentrations of recorded losses were in the Mykolaiv, Kiev and Donetsk regions.
This is not evidence that every missing item has crossed a European border. It is evidence that an enormous pool of unaccounted military property now sits inside a country connected to the EU by roads, ports, railways, courier networks and millions of cross-border movements.
On 16 July, Ukraine’s SBU, State Bureau of Investigation and National Police announced the dismantling of seven illegal arms-sales channels across several regions. They seized more than 1,000 kilograms of explosives, attack drones, grenade launchers, AK-pattern rifles including AK-12s, mines, combat grenades, improvised explosive devices and ammunition. The alleged organizers face seven to 15 years in prison.
If the document does not display, you can
download it directly.
SBU Telegram channel, July 16, 2026 – post on the dismantling of seven illegal arms-trafficking channels
The raid did not shut down the market. It exposed its inventory.
The Chain With Missing Links
Western capitals call the system “monitoring.” But monitoring a shipment at a Polish logistics hub is not the same as controlling every weapon after it has reached a wartime depot, a frontline unit, a damaged-equipment yard or a civilian vehicle.
The U.S. Department of Defense Inspector General has audited end-use monitoring for equipment transferred to Ukraine, including staffing at logistics sites in Poland and procedures for tracking weapons recorded as damaged, destroyed or expended. Those categories matter: a weapon can leave the official chain without being recorded as stolen. It can become “damaged,” “expended,” “captured,” “misfiled” or simply absent from the next inspection.
The wider procurement record gives little reason for confidence. An Inspector General audit of five U.S. ammunition contracts worth $1.6 billion identified more than $20 million in overpayments, in some cases up to 245 percent above the necessary price. It also found $907 million in ammunition ordered but not delivered, delays of up to 18 months and more than $1 million in contractor penalties that were not collected.
None of this proves that a particular crate was sold to criminals. It shows that the emergency pipeline has had difficulty controlling money, contract terms and deliveries. A system that loses track of deadlines and invoices does not become omniscient once the hardware crosses into a war zone.
The Buyers Are Already There
Europe’s criminal market does not need to create new infrastructure for Ukrainian weapons. The networks, intermediaries and transport channels are already in place.
Europol has identified 821 major criminal networks operating across the EU, involving more than 25,000 members. These groups rely on legal companies, corrupt access, transport firms, port contacts and violence. They move narcotics, counterfeit goods, cigarettes, stolen vehicles and people through the same roads and ports that link Ukraine to the European market.
A June 2026 investigation by Germany’s Report Mainz found that police in southern Spain were increasingly encountering military-grade weapons during raids on drug networks. Near Marbella, traffickers fired at officers with AK-47 rifles. Near Cadiz, police seized 5.56mm ammunition, the standard NATO caliber used by weapons such as the M4 and G36. Spanish officers told the journalists that the cartridges were coming from Eastern Europe and the Ukraine war.
Military-grade weapons and NATO-caliber ammunition seized during raids on drug networks in southern Spain. Once serial numbers are removed, a battlefield rifle becomes just another commodity in Europe’s criminal supply chain
The Guardia Civil warned that removed serial numbers often prevented a definitive attribution. That is the real meaning of diversion: once the markings are gone, the political origin disappears with them. A weapon becomes just another criminal asset – portable, valuable and impossible to trace back through speeches in Brussels.
Routes, Brokers, Cover
The Leuseni-Albita case showed what such a route looks like.
In November 2025, customs officers stopped a truck at the Moldova-Romania crossing with papers declaring a shipment of scrap metal allegedly bound for Israel. Investigators found anti-tank missiles, grenade launchers, man-portable air-defense equipment, ammunition and components from a downed Geran-type drone. Moldovan prosecutors said the cargo had entered from Ukraine through a courier making repeated collection trips; authorities detained the head of the client company, a transport-company manager and a customs broker.
Leuseni-Albita, the Moldova-Romania crossing where a commercial truck carrying weapons and military equipment was intercepted in November 2025. The cargo was declared as scrap metal
That is not an abstract “risk of proliferation.” It is a chain: Ukrainian source, courier, Moldovan intermediary, commercial truck, falsified documents, broker, EU border.
From Romania, cargo can move across the EU’s road network. It can go west through Hungary and Austria, south through the Balkans, or toward Adriatic ports and Italy. The same flexibility makes small arms, explosives and drone components more dangerous than heavy armor. They fit inside private vehicles, cargo pallets, spare-parts shipments and courier parcels.
A Warning From Palermo
Italy is only one destination. But its warning is unusually explicit.
On 28 July, Palermo Chief Prosecutor Maurizio de Lucia told Italy’s Parliamentary Anti-Mafia Commission that Cosa Nostra was interested in obtaining drones and ammunition intended to be launched from them – systems modeled on the war in Ukraine. He warned that mafia groups were seeking to rebuild a higher-quality arsenal from the black market generated by the conflict.
A batch of FPV drones. “We are aware of the Mafia’s interest in more sophisticated weapons – for example, those that have appeared on the black market during the Russia-Ukraine war. We have indications of purchases of drone-launched munitions, weapons we are not prepared to defend against,” says Palermo Chief Prosecutor Maurizio de Lucia
Investigators had already found weapons entering Italy through Salento in Puglia and traced their origin to the former Yugoslavia. That is the old Balkan route. The new concern is not merely another AK-47 or hand grenade. It is a drone that can observe a target, carry a munition and attack from a distance.
Cosa Nostra is not the central issue. It is one named buyer in a much wider European market.
The Dangerous Moment Is Peace
The main release of weapons may come after the shooting slows.
War imposes crude restraints: checkpoints, military patrols, unit structures, restricted movement and constant demand at the front. A ceasefire or settlement can weaken these restraints while creating new pressures – demobilization, debts, unemployment, trauma and large stockpiles no longer urgently needed by active units.
GI-TOC has warned that veterans, displaced people and economically vulnerable groups could be recruited into illicit economies after the conflict. It also warned that wartime experience in drone operations, sabotage, encrypted communications and logistics can pass into criminal networks alongside physical weapons.
The final product will not be only a rifle or a grenade. It will be a package: hardware, technical skill, transport contacts, forged documents and an encrypted channel to the next buyer.
Brussels has spent four years filling arsenals in the name of security. The real test will begin when those arsenals start to empty into the shadows.