Bulgaria keeps finding drones on its beaches. The government says most are Russian — but won't release the proof.
Bulgaria's navy has recovered dozens of drones from its Black Sea coast since 2023, most without explosives, but the government won't publish the forensic evidence needed to confirm its claim that most were Russian.
What is the documented origin, assessed threat level, and official government confirmation regarding drone activity on Bulgaria's Black Sea coast?
- 1Bulgarian naval teams documented a steady run of drone finds along the coast through August and September 2026, including six detection-and-neutralization operations on a single day, September 2.
- 2In case after case, recovered drones carried no explosives — the Kabakum drone, the Cape Galata drone and the Kranevo-Albena debris all came ashore inert.
- 3Defence Minister Dimitar Stoyanov said most of the drones were Russian and none was hazardous, but the ministry did not publicly release the manufacturer, model or country of origin for most finds.
- 4When Bulgaria did attribute one incident specifically, it pointed the other way: the Kardam wreckage was assessed as most likely a Ukrainian-made Maya drone.
- 5A maritime security firm counted 56 war-related objects across the Black Sea from March to August 2026, roughly double the previous six months, with at least a third carrying live ammunition.
For two years, Bulgaria's navy has been pulling wrecked drones off its beaches — sometimes six in a single day. The country's defence minister says most were Russian, but the ministry won't release the forensic details that would prove it, and the one incident they did analyse in public turned out to be a Ukrainian-made drone. Ukraine denies aiming anything at Bulgaria, and an independent fact-checking network found no evidence anyone staged the incidents to frame Kyiv. Most of the drones that washed ashore carried no explosives, though one in 2023 had an 82mm mortar shell attached. A maritime security firm counted 56 war-related objects across the Black Sea between March and August 2026 — double the previous six months — with at least a third carrying live ammunition. The surge is real, the navy's response has been effective, and the immediate danger appears low. What's missing is the one thing that would settle where the drones actually came from: a published technical report with serial numbers, propulsion details and payload analysis tying each find to a specific military inventory. Until that exists, the official story rests on ministerial authority rather than evidence anyone outside the defence ministry can check.
The Full Investigation
8 sections · 12 min read
Confirmed facts and attributed reporting read normally; only contested, unverified, or speculative sentences are highlighted. Hover any sentence for its grade and sources.
A NATO coastline keeps finding other people's war on its beaches
For nearly two years, Bulgarian sailors have been doing a strange kind of beachcombing. They pull wrecked drones out of the surf, defuse the ones that might explode, and haul the rest back to base — and their own government still hasn't given citizens a clear, evidence-backed answer about where all this hardware comes from.
The story starts with the war next door. Russia's full-scale invasion of Ukraine in February 2022 turned the Black Sea into a live military theater. Bulgaria sits on the sea's western edge, a NATO member watching a conflict it is not part of spill onto its shore. The first hard sign came in September 2023, when a navy team defused an explosive drone near the coastal town of Tyulenovo — the first drone found on Bulgarian territory. It carried an 82mm mortar shell, which the team destroyed in a controlled blast.
Then came 2026, and the trickle became a wave. Drones and drone parts washed up along the coast almost weekly through that summer. This report walks through what the navy and defence ministry have actually confirmed, what officials claimed about the drones' origin, how dangerous they were judged to be, who disputes the official story, and what independent analysts add. The central tension runs underneath all of it: Bulgaria has been very clear about what it found, and far less clear about where it came from.
The 'Russian' label came from the minister, not from published evidence
So the navy knows exactly what it pulled from the water. The harder question is where the drones came from — and here the confident public story and the published evidence pull apart.
The headline attribution belongs to one man. Defence Minister Dimitar Stoyanov said on August 26, 2026 that most of the drones found on Bulgaria's coast in recent weeks were Russian. That statement is firmly on the record — the state broadcaster and The Sofia Globe both carried it. But it is an interested-party claim unaccompanied by published evidence: for most of the incidents, Bulgaria's defence ministry did not publicly identify the manufacturer, model or country of origin. For the September 2 drones specifically, the ministry disclosed no origin or exact type at all. Even for the individual Kabakum drone, neither origin nor model had been officially established at the time of reporting.
That gap matters because when Bulgaria did attribute a single incident with any specificity, it pointed away from Russia. A preliminary assessment of the Kardam wreckage indicated it was most likely a Maya drone — a Ukrainian-made type — though that assessment remains contested. Sources differ slightly on the wording, some calling it a decoy and some describing it as a Maya drone used by Ukraine, but the underlying preliminary assessment agrees: this one looked Ukrainian, not Russian. One earlier find, near the coast in late July, visually resembled a Russian Gerbera drone, but even that resemblance came with a caveat — its origin was not officially confirmed.
So the on-record attribution picture is lopsided in an awkward way. There is a broad ministerial claim that most drones were Russian, unaccompanied by public forensic detail; one specific incident assessed in preliminary examination as Ukrainian-made, though that finding is contested; and a long list of finds whose origins the ministry simply has not stated.
Open: Whether Bulgaria's defence ministry ever produced an internal technical attribution report — with serial numbers, propulsion type or payload analysis — that would substantiate the Russian-majority claim.
Officials called the drones non-hazardous — with one armed exception on the record
If the origin question stayed murky, the danger question got a much cleaner official answer. The government's message was reassurance, and much of the physical evidence backed it up.
Minister Stoyanov was blunt: none of the recent drones was hazardous. He described them as either reconnaissance or decoy drones posing no danger because they were not carrying ammunition. The recovered hardware supported that. The Cape Galata drone had no explosive substance, the Kabakum drone contained no explosives and was transported to base, and the Kranevo-Albena debris was classified as a decoy drone without explosives. Stoyanov also tied the growing number of finds to the intensity of the fighting around Odesa and Izmail — framing the drones as spillover from a nearby battle, not an attack on Bulgaria.
But the reassurance is not the whole record, and one exception is important. The very first drone found on Bulgarian soil, near Tyulenovo in September 2023, carried an 82mm mortar shell that had to be destroyed in a controlled explosion. That shows armed drones can and do reach the coast — the reassuring pattern of 2026 was not the only pattern. President Iliana Iotova struck a more anxious note, saying Bulgaria has significant gaps in the systems needed to counter drones and that the drones are becoming increasingly sophisticated, while also insisting there was no direct threat to the country. Those two statements sit uneasily together, and both come from a single weakly-sourced account, so they carry less weight than the minister's on-record remarks.
Bulgaria was not alone in this work. Just across the water, Turkey's defence ministry reported that its underwater teams destroyed suspicious objects assessed as possible drones or kamikaze naval craft, with round-the-clock surveillance against drifting mines — a reminder that the whole Black Sea is dealing with the same debris.
Open: Whether the August 2026 finds were unusually benign, or representative — no comprehensive explosive-ordnance-disposal breakdown of every incident was published.
Ukraine denied sending drones, and no false-flag evidence surfaced
Every attribution claim has a mirror image: someone being blamed. In this story, that someone is Ukraine — and Ukraine pushed back hard.
The denials were emphatic and came from the top. Ukrainian foreign ministry spokesman Georgiy Tykhyi stated that Ukraine's armed forces did not intentionally direct any assets toward Bulgaria, and promised an inquiry. Ukraine's ambassador said the same and offered cooperation in the investigation. These are statements from an interested party, and they came without operational logs or flight data to prove the negative. But they are consistent with each other and were made publicly and repeatedly.
Crucially, an independent check exists. The European Digital Media Observatory, a research network that tracks disinformation, found no convincing evidence of a Ukrainian false-flag operation in any of the drone incidents involving Russian or Ukrainian drones. That does not prove no Ukrainian drone ever drifted to Bulgaria — the contested preliminary assessment of the Kardam wreckage as a Maya drone suggests at least one may have. It addresses a narrower and pointed question: whether anyone staged incidents to frame Ukraine. On that, the answer from an outside body was no.
The honest summary is that the alternative explanations here are thinner than the official one. There is no pro-Russian counter-narrative in the evidence base contesting the finds. The main alternative to the ministry's Russian-majority framing is not a rival accusation but an absence: Ukraine says it wasn't us, the ministry hasn't shown its origin evidence, and one contested preliminary assessment points to Ukrainian hardware.
Open: Whether Ukrainian operational flight records for the Kardam dates would confirm the drone was lost or drifted rather than directed — no such records have been published.
Independent analysts confirm a surge but can't verify origin from wreckage alone
When the government won't publish its forensics, outside analysts become the reader's best independent check. Here, they confirm the scale of the problem while quietly underlining how hard attribution really is.
The hardest outside number comes from Ambrey, a maritime security consultancy. It counted 56 war-related objects across the Black Sea basin between March and August 2026, compared with 27 in the previous six-month period — roughly double. At least a third of those objects carried live munitions. One caveat matters: this is a Black Sea-wide count, not a Bulgaria-specific one, so it does not contradict the Bulgarian ministry's finding that its own recent coastal drones were mostly inert. The two operate on different scopes. Ambrey went further and concluded that drones have become the main threat in the basin, replacing naval mines — but that is an expert forecast, an interpretation rather than a documented fact.
The analysts also flagged the single biggest obstacle to trusting any origin claim: drift. AdriaDefense noted that sea currents can carry floating wreckage over significant distances, so where a drone reaches the coast does not necessarily show where it operated or entered the water. That is analytical context, not proof about any one drone, but it cuts directly against tidy origin stories drawn from landing spots. The Kardam drone, which flew in over land from Romania, is a reminder that these machines travel far from home before they come down.
What is missing from the independent record is telling. No academic, military-technical or forensic laboratory examined the recovered drones and published a result. The outside verification runs to consultancy risk assessments and disinformation research — valuable, but not the serial-number-level analysis that would settle origin. On the core attribution question, the independent sources confirm the surge and the ambiguity in equal measure.
Open: Whether any non-Bulgarian technical body will publish a forensic examination of the recovered drones to test the Russian-origin claim independently.
Competing explanations: Russian spillover, mixed incursions, or an unproven official story
Pull the threads together and a few competing explanations emerge, each fitting some of the evidence and straining against the rest. None is fully proven, and the reason is always the same: the missing forensics.
The first and simplest reading is the official one — that most of the drones are Russian, lost or overflown during Russia's operations near Odesa and Izmail. It draws real support from the minister's on-record attribution, his framing of the finds as conflict spillover, and the late-July drone that looked like a Russian Gerbera. Its weak point is sharp: the one incident Bulgaria assessed specifically in a preliminary examination pointed to a Ukrainian-made Maya drone, though that assessment remains contested, and no published technical report backs the Russian majority. This explanation is plausible but rests on ministerial authority, not evidence anyone else can check.
A second reading holds that the coast is seeing a mix — some Russian, at least one Ukrainian, and many simply unidentified. This fits the evidence more comfortably than either single-origin story, because it takes both the Russian-majority claim and the contested Kardam Maya finding at face value, and it absorbs the long list of finds whose origin the ministry never stated. It is the explanation that requires the fewest facts to be wrong. What it cannot do is give the real proportions, because the underlying attribution work was never published.
A third reading focuses on danger rather than origin, and here the evidence is stronger. The claim that the drones posed little immediate threat is well supported: multiple finds came ashore without explosives, echoing the minister's assessment. The counterweights are the armed Tyulenovo drone of 2023 and Ambrey's basin-wide finding that at least a third of war objects carried live munitions — proof that armed drones exist even if Bulgaria's recent haul was mostly inert. On Ukraine's conduct, a fourth reading — that no Ukrainian drone was deliberately aimed at Bulgaria — is supported by the official denials and, more importantly, by EDMO's independent finding of no false-flag evidence. EDMO's finding rules out a staged false-flag operation specifically, not the broader question of whether the Kardam drone drifted or was directed; whether the Kardam flight path was deliberate or the result of drift is unresolved in the record. Drift offers a plausible innocent path for a Ukrainian-made find, but no operational records have been published to confirm it.
What would settle any of this is the same single thing: a comprehensive Bulgarian technical attribution report, incident by incident, with serial numbers, propulsion and payload tied to Russian or Ukrainian inventories. Until that exists, the mixed-incursion reading is the safest fit, the low-threat reading is the best-evidenced, and the clean Russian-majority story remains an assertion rather than a demonstration.
What the evidence forces, and what it leaves open
Strip away the diplomacy and the reassurance, and the evidence forces a small number of firm conclusions and leaves the biggest question hanging.
What is settled: the finds are real, documented and numerous, from the six-operation day on September 2 to the destroyed drone off St Ivan Island. It is also settled that most of the recently recovered drones carried no explosives, and that Bulgaria's navy has repeatedly shown it can detect and neutralize them. On the diplomatic front, Ukraine's denials are on the record, and no outside body found evidence they were staged.
What is not settled — and the evidence forces this admission too — is origin. The Russian-majority label is a genuine ministerial statement, but the ministry withheld the manufacturer, model and origin data for most incidents, and one specific incident received a contested preliminary assessment pointing to a Ukrainian-made drone. That combination cannot support a confident conclusion that most drones were Russian; it can only support the narrower finding that a senior official said so without publishing the proof. The most defensible reading of the whole record is mixed origins with incomplete official attribution.
One forward-looking judgment is worth stating carefully as an interpretation rather than a fact. Ambrey's assessment that drones have displaced mines as the primary Black Sea threat is an expert forecast, and President Iotova's acknowledgment of significant counter-drone capability gaps — though weakly sourced — points the same direction. If both are right, the beachcombing is not ending soon, and the gap between what Bulgaria can recover and what it can explain is likely to keep widening.
Why it matters
Bulgaria is a NATO member with foreign military hardware landing on its beaches almost weekly, and the gap between what its government can confirm and what it can explain is the real story. Officials have shown they can find and neutralize the drones, and they have reassured citizens the recent finds carried no explosives. But the confident claim that most were Russian sits on ministerial say-so while the origin data stays unpublished, and one incident was assessed as Ukrainian-made. With a maritime security firm reporting war debris in the Black Sea roughly doubling in six months, and the president conceding real gaps in Bulgaria's counter-drone defenses, the pressure to either publish the evidence or modernize the shield is only going to grow.
- The exact baseline dates for Ambrey's comparison period of 27 objects, described only as the previous six-month period.
- Whether Bulgaria's defence ministry ever produced a comprehensive technical attribution report — with manufacturer, model, serial numbers or payload forensics — establishing the origin breakdown of the recovered drones, and if such a report exists, why it has not been made public.