Exclusive: Inside Russia's shadow fleet
An investigation by the Kyiv Independent reveals that Russia’s shadow fleet uses Starlink and cryptocurrency, and identified Ukrainians recruited for maritime jobs who later worked on shadow fleet tankers now under investigation by the FBI and SBU.
The oil tanker Kairos, a Gambian-flagged vessel and part of Russia's "shadow fleet," anchored off the coast of Ahtopol, Bulgaria, on Dec. 8, 2025. (Hristo Rusev / Getty Images)
on GoogleThe vessels are old, their hulls streaked with rust, and their ownership obscured behind layers of shell companies.
Yet the tankers that make up Russia’s so-called shadow fleet, the armada used to move sanctioned oil across the globe, are kept running with modern Western technology including Starlink, an investigation by the Kyiv Independent can reveal.
To gain an insight into how the shadow fleet operates, the Kyiv Independent spoke to two Ukrainian sailors who claim they unwittingly became part of one of the Kremlin's major money-making operations used to fund its full-scale invasion of their country.
"I didn't know we were recruited (by the Russian shadow fleet), because I didn't even know who recruited us. Everything was in a telephone conversation, we were sent documents, we signed them, sent them back, they gave us tickets," one Ukrainian crew member said.
"They called through WhatsApp using British cell phone numbers," he added.
The sailors — who all only agreed to speak on the condition of anonymity due to ongoing criminal investigations — describe a clandestine but highly sophisticated system. Many of the vessels are aging tankers acquired second-hand. Replacement parts and technical services are frequently funneled through intermediaries, including companies based in China, Namibia, Oman, helping obscure the origin and final destination of equipment essential to keeping the ships operational.
Job openings may surface without warning in seafarers’ WhatsApp, Telegram, or Instagram group chats, typically accompanied by a terse description of the position and a departure date.
Sometimes the invitation arrives more casually — a direct call from a former colleague. "Let’s go and work together," one crew member recalled being told.
"They called me like you are calling, we spoke a bit and they offered a position, said 'here is the ship'," one crew member recalled.
In most cases, those interviewed said, few questions are asked. The promise of steady pay is often enough. There are typically no formal interviews. If a mariner has the required certifications and documents, he is hired.
The Starlink connection
According to Maritime News, as of October Russia's shadow fleet consisted of 3,240 vessels transporting 337 million barrels of oil a month. At the time of writing, the EU has sanctioned 600 vessels, the UK 500, while the U.S. remains at 216, having failed to sanction a single new tanker under the current administration.
Communication between shadow fleet tankers and their owners is often maintained using Western technology, including satellite phones and Starlink terminals, two Ukrainian sailors, told the Kyiv Independent, who between them worked aboard multiple ships. Two other sources who worked aboard other Russian shadow fleet vessels also confirmed to the Kyiv Independent that Starlink is used.
"It could be purchased through a proxy company. As far as I know, it is difficult to buy a Starlink in Ukraine now. Elsewhere in the world, you can simply order it and have it delivered by mail," one of the crew members said.
"It is not a weapon, everybody can buy it," they added, recalling that access to Starlink for the crew is typically limited in time and bandwidth, while the captain retains unrestricted connectivity, allowing direct contact with shipowners and intermediaries throughout the voyage.
It has been previously reported Russian forces have long been using unauthorized access to operate drones and other military equipment in occupied areas of Ukraine during the Russian full scale invasion of Ukraine.
This was effectively switched off last month after the Ukrainian government, in cooperation with SpaceX, introduced a mandatory registration and "whitelist system” — but its use aboard Russian shadow fleet vessels has not previously been reported.
"If Starlink is being used to evade sanctions or bypass maritime safety rules, this is unacceptable," Vladyslav Vlasiuk, the Ukrainian president's representative on sanctions policy, told the Kyiv Independent.
"We expect SpaceX to review this issue carefully and take steps to prevent the use of Starlink by shadow fleets of any country, including Russia, Venezuela, or Iran," he added.
SpaceX had not responded to a Kyiv Independent request for comment at the time of publication.
The crypto connection
Payments add another layer of ambiguity to operations. Wages are often made in cash or in cryptocurrency, according to those interviewed.
An independent advisor to intelligence and law enforcement agencies, Richard Sanders, examined cryptocurrency payments to four dozen shadow fleet crew members from four different ships. In most cases, the payments were made in Tether (USDT).
Sanders told the Kyiv Independent there is significant overlap between the Russian, Venezuelan and Iranian shadow fleets, with shared financial infrastructure underpinning their operations.
According to his findings, funds in the Russian shadow fleet often originate from Bitcoin mining, are converted into stablecoins, and then distributed to digital wallets controlled by crew members.
“I am aware of the fact they use USDT to pay fleet members,” he said, describing a system in which monthly salaries on the lower end range from $2,000 to $3,000.
Two sailors confirmed that operating costs of a single vessel with a crew of around 30 can amount to $120,000 per month in salary payments, or nearly $1.5 million annually.
Some crew members described the work as "easy money" largely because the vessels often avoid formal port calls and the inspections that typically accompany them. With fewer tanker inspections and less regulatory scrutiny in port, the voyages can proceed with minimal interference, they said.
Rather than docking at a port, tankers often transfer oil through ship-to-ship operations conducted offshore at times with their Automatic Identification System, or AIS, transponders switched off, obscuring their movements from public tracking data. The insiders said, sometimes tankers can spend months in the open sea waiting for the client.
The Ukrainian crew of the Bella-1
Days before the United States launched a military operation in Venezuela, culminating in the arrest of President Nicolas Maduro and a push for regime change, the Bella-1 appeared in the Caribbean, where the U.S. had begun enforcing a sweeping oil blockade targeting the regime’s illicit exports.
The vessel, sanctioned in 2024 by the U.S. Treasury’s Office of Foreign Assets Control over allegations it carried illicit cargo for a Hezbollah-owned company, refused orders from the U.S. Coast Guard and fled into the Atlantic, triggering a two-week pursuit.
During the chase, the ship attempted to evade capture by renaming itself Marinera and changing its flag to Russian, while Moscow reportedly dispatched a submarine to escort the tanker.
The U.S. Justice Department secured a seizure warrant based on its history of transporting Iranian oil for groups linked to terrorism. As a consequence of failing to obey the Coast Guard’s orders for weeks, 28 crew members of the vessel were arrested by U.S. authorities, and 26 of them released, with criminal charges to be pursued against the remaining two culpable actors.
Seventeen Bella-1 crew members were Ukrainian nationals, who are now the subjects of the investigations by Ukraine’s Security Service (SBU), according to three sources, including a Ukrainian top official and two crew members interviewed by SBU.
The SBU did not respond to a Kyiv Independent request for comment by the time of publication.
Since the start of Russia's full-scale invasion, Ukraine has repeatedly urged partners to modernize legislation so vessels operating under Russia's shadow fleet can be seized and their oil redirected to support European security.
Though slow to take action, several countries are now ramping up efforts to disrupt the shadow fleet — in early March, Belgium conducted a joint operation with France to seize a sanctioned Russian oil tanker operating under the Guinean flag.
And on March 25, the U.K. announced that its armed forces and law enforcement personnel will be authorized to board Russian shadow fleet vessels in British waters.
The US seized six shadow fleet oil tankers off the coast of Venezuela in the first two months of 2026 as a part of its blockade of sanctioned oil shipments to and from the country.
The two Bella-1 Ukrainian crew members interviewed by the Kyiv Independent denied having any knowledge of the ship’s involvement in the Russian shadow fleet.
Contracts list routine cargo operations, final destinations are left vague or subject to change. Besides the true owner of the oil and its ultimate buyer, only three people aboard a tanker — the captain, the chief engineer, and a senior officer — usually know the full details of a voyage, they said.
"Maybe if you are the captain of a ship, you might know. But if you are a regular crew member, what can you know?" another crew member said.
"We all live in Europe, and it’s expensive. We need to help at home, to help our parents. We need to support the Ukrainian Armed Forces.," the sailor explained.
"I spent eight months on this ship, and for six of them, I had no reason not to work. It was a regular job, nothing different from the other companies I’ve worked for," he added.
The crew members of the seized oil tanker Bella-1 said they suspected nothing until they were told the ship's destination.
"When they told us we were heading toward Venezuela, we said, ‘We will not go.’ They answered, ‘You are going to Curaçao, where all the crew will be changed,’" one said.
"Then, after rumors spread that the ship would change its registration to Russian, we also refused. Later, the chase began, which ultimately resulted in the ship’s arrest," he added.
While being pursued by the U.S. Coast Guard for almost two weeks, they said they were forced to delete all communication and correspondence related to the tanker, which changed its flag to Russian during the voyage.
"I refused my duties from the very first day of the chase," the other crew member recalled.
"We burned all the documents and deleted the correspondence. What happened on the ship was terrible, because they said they would destroy all the contracts and everything else, they wanted to escape," one of the Bella-1 crew members told the Kyiv Independent.
"They had their own security department on the ship, their own 'reshaly' (problem solvers). I was surprised at first, but later I realized it wasn’t my place to question it, I wasn’t the one paying their salaries, so I didn’t care," another crew member recalled.
The security officers were also Ukrainian. "When the chase started, they took control, and it was their fault. Ironically, they were let go (by the Americans), but the Security Service of Ukraine is now looking for them as far as I know," he added.
"As I understood, they had a plan — if the ship became Russian, the Americans would let us go. It was naive to think that way," another crew member said.
Hi this is Chris York, the editor of this investigation. Exposing how Russia's shadow fleet uses Western technology to help fund the Kremlin's war machine is vital work, and the Kyiv Independent can only do this with your support.
Please consider becoming a member of the Kyiv Independent so we can continue to publish more investigations like this one.
