On 26 September 2022, a series of underwater explosions and consequent gas leaks occurred on 3 of 4 pipes, that were rendered inoperable, of the Nord Stream 1 (NS1) and Nord Stream 2 (NS2) natural gas pipelines, two of 23 gas pipelines between Europe and Russia. The leaks were located in international waters, but within the economic zones of Denmark and Sweden. Both pipelines were built to transport natural gas from Russia to Germany through the Baltic Sea, and are majority owned by the Russian majority state-owned gas company, Gazprom.

Prior to the leaks, the pipelines were filled with natural gas but were not transporting it as a consequence of the Russian invasion of Ukraine. The leaks occurred one day before Poland and Norway opened the Baltic Pipe running through Denmark, bringing in gas from the North Sea, rather than from Russia as the Nord Stream pipelines do.

Russia asked for an international investigation at the UN Security Council which was rejected with 3 votes in favor out of 15. Denmark, Germany and Sweden each initiated separate investigations, describing the explosions as sabotage. The Swedish and Danish investigations were closed in February 2024 without identifying those responsible, but the German investigation is still ongoing. In August 2024 media reported that in June German authorities issued a European arrest warrant for a Ukrainian national suspected of having used the sailing yacht Andromeda together with two others to sabotage the Nord Stream pipeline. As of June 2024 the suspect is still at large, having reportedly left the EU for Ukraine.

In 2021, Russia supplied roughly 45% of the natural gas imported by European Union states. The United States has been a major opponent of the Nord Stream pipelines. Former US President Donald Trump said in 2019 that Nord Stream 2 could turn Europe into a "hostage of Russia" and placed sanctions on any company assisting Russia to complete the pipeline. In December 2020, then President-elect Joe Biden came out forcefully against the opening of the new pipeline and the impact this would have on potential Russian influence. In 2021, the Biden administration lifted the sanctions, stating that while it was "unwavering" in opposition to Nord Stream 2, removing the sanctions was a matter of national interest, to maintain positive relations with Germany and other US allies in Europe. The second pipeline was completed in September 2021. On 7 February 2022 in a joint press conference with German Chancellor Olaf Scholz, US President Joe Biden said that "we will bring an end to it [Nord Stream]" if Russia invades Ukraine and reemphasised with a promise to do it when asked how, delivering on that promise two days before Russia's 24 February invasion when Germany suspended certification.

Prior to being sabotaged neither of the Nord Stream pipelines were delivering gas. Nord Stream 2 had been completed in 2021, but had not entered service because Germany had suspended its certification on 22 February 2022 thereby stopping the project, following official recognition of the Donetsk People's Republic and Luhansk People's Republic by the Russian State Duma and President Putin during the prelude to the 2022 Russian invasion of Ukraine. From 31 August 2022, Gazprom had halted delivery via Nord Stream 1 indefinitely, officially because of maintenance.

Both Nord Stream 1 and 2 were however pressurized with gas. The Nord Stream 2 pipeline contained the equivalent of an estimated 150 million cubic metres (5.3 billion cubic feet) to 300 million cubic metres (11 billion cubic feet) of gas, pressurized to over 100 bar, at the time of the explosions.

An environmental impact assessment of NS2 was made in 2019. By 2012, corrosion leaks had only occurred in two large pipelines worldwide. Leaks due to military-type acts and mishaps were considered "very unlikely". The largest leak in the analysis was defined as a "full-bore rupture (>80 mm [3.1 in])", for example from a sinking ship hitting the pipeline. Such an unlikely large leak from 54 metres (177 ft) water depth could result in a gas plume up to 15 metres (49 ft) wide at the surface.

For NS2, the pipes have an outer diameter of approximately 1,200 millimetres (48 inches) and a steel wall thickness of 27–41 millimetres (1.1–1.6 in) – thickest at the pipe ingress where operating pressure is 22 megapascals (220 bar) and thinnest at the pipe egress where operating pressure is 17.7 megapascals (177 bar), when transporting gas. To weigh down the pipe (to ensure negative buoyancy), a 60–110-millimetre (2.4–4.3 in) layer of concrete surrounds the steel. Each line of the pipeline was made of about 100,000 concrete-weight coated steel pipes each weighing 24 tonnes (53,000 lb) welded together and laid on the seabed. To facilitate pigging, the pipelines have a constant internal diameter of 1,153 millimetres (45.4 in), according to Nord Stream. Sections lie at a depth of around 80–110 metres (260–360 ft).

The Geological Survey of Denmark said that a seismometer on Bornholm showed two spikes on 26 September: the first P wave at 02:03 local time (CEST) indicated a magnitude of 2.3 and the second at 19:03 a magnitude of 2.1. Similar data were provided by a seismometer at Stevns, and by several seismometers in Germany, Sweden (as far away as the station in Kalix 1,300 kilometres or 810 miles north), Finland and Norway. The seismic data were characteristic of underwater explosions, not natural events, and showed that they happened near the locations where the leaks were later discovered. Around the same time, pressure in the non-operating pipeline dropped from 10.50 to 0.70 megapascals (105 to 7 bar), as recorded by Nord Stream in Germany.

After Germany's initial report of pressure loss in Nord Stream 2, a gas leak from the pipeline was discovered by a Danish F-16 interceptor response unit 25 kilometres (16 mi) southeast of Dueodde, Bornholm. Nord Stream 2 consists of two parallel lines and the leak happened in line A inside the Danish economic zone. Citing danger to shipping, Danish Maritime Authority closed the sea for all vessels in a 5-nautical-mile (9.3 km; 5.8 mi) zone around the leak site, and advised planes to stay at least 1,000 m (3,300 ft) above it.

Hours after the German office of Nord Stream had reported pressure loss in Nord Stream 1, two gas leaks were discovered on that pipeline by Swedish authorities. Both parallel lines of Nord Stream 1 were ruptured and the sites of its two leaks were about 6 kilometres (3.7 mi) from each other, with one in the Swedish economic zone and the other in the Danish economic zone. On 28 September, the Swedish Coast Guard clarified that the initially reported leak in the Swedish economic zone actually was two leaks located near each other, bringing the total number of leaks on the Nord Stream pipes to four (two in the Swedish economic zone, two in the Danish).

Danish Defence posted a video of the gas leak on their website which showed that, as of 27 September, the largest of the leaks created turbulence on the water surface of approximately 1 kilometre (0.62 mi) in diameter. The smallest leak made a circle of about 200 metres (660 ft) in diameter. Analysts noted the much larger plumes as an indication that the rupture is very large, compared to a presumed technical leak plume of 15 metres (49 ft).

The SwePol power cable between Sweden and Poland passes near two of the leak sites, and was investigated for damage. Tests by Svenska Kraftnät, published on 4 October, indicated the cable was not damaged.

The Swedish Navy confirmed that its ships had patrolled the area in the days before the explosions, but would not comment on why it had done so. An analysis of AIS-data from MarineTraffic by Swedish media Dagens Nyheter showed Swedish navy vessels in the areas on 21 and 22 September 2022, from five to four days before the sabotage. During the night of the explosions the analysis showed no Swedish vessels in the area.

On 1 October, the Danish Energy Agency reported that one of the two pipelines, Nord Stream 2, appeared to have stopped leaking gas as the pressure inside the pipe had stabilized. The following day, the same agency reported that the pressure had stabilized in both Nord Stream 1 pipelines as well, indicating that the leakage had stopped. In contrast, Swedish authorities reported on 2 October that gas continued to escape from the two leaks in their economic zone, albeit to a lesser extent than a few days before.

The three leaks that appeared at roughly the same time were relatively close to each other with their gas plumes confined by a 7-nautical-mile-wide (13 km; 8.1 mi) exclusion zone straddling the boundary between the economic zones (EEZ) of Denmark and Sweden.

The distance between the southern- and northernmost leaks is 79 kilometres (49 mi).

26 September 2022 Nord Stream leaks

Pipe	EEZ	Coordinate	Time CEST	Richter scale	Distance to land	Discoverer
NS 2 pipe A	Denmark	54°52.6′N 15°24.6′E / 54.8767°N 15.4100°E / 54.8767; 15.4100 (DANGER AREA 1 RAD 5 NM)	02:03	2.3	25 km (roughly southeast of Dueodde Lighthouse)	Danish F-16 interceptor response unit
NS 2 pipe A	Sweden	55°32.1′N 15°41.9′E / 55.5350°N 15.6983°E / 55.5350; 15.6983 (DANGER AREA 2 RAD 5 NM)	19:03	2.1	85 km (east of Simrishamn)	Swedish authorities. Second leak on that pipe, initially reported as a single leak with NS 1 Pipe A
NS 1 pipe A	Sweden	55°33.4′N 15°47.3′E / 55.5567°N 15.7883°E / 55.5567; 15.7883 (DANGER AREA 3 RAD 5 NM)	19:03	2.1	44 km (roughly south of Utklippan)	Swedish authorities. Initially reported as a single leak with NS 2 Pipe A
NS 1 pipe B	Denmark	55°32.45′N 15°46.74′E / 55.54083°N 15.77900°E / 55.54083; 15.77900 (DANGER AREA 4 RAD 5)	19:03	2.1	61 km (roughly north-northeast of Svaneke)	Swedish authorities

The table's timestamps and Richter scale magnitudes are from seismic data characteristic of underwater explosions and matching the locations of the leaks.

The Geological Survey of Denmark said that the tremors that had been detected were unlike those recorded during earthquakes, but similar to those recorded during explosions each with a magnitude corresponding to a "larger WW2 bomb". The Swedish public service broadcaster SVT reported that measuring stations in both Sweden and Denmark recorded strong underwater explosions near the Nord Stream pipelines. The day after the attack Björn Lund, Associate Professor in Seismology at The Swedish National Seismic Network said "there is no doubt that these were explosions". The German newspaper Der Tagesspiegel wrote that the leaks were being investigated for whether they may have been caused by targeted attacks by submarine or clearance divers.

On 30 September 2022, Denmark and Sweden jointly submitted a letter to the United Nations Security Council stating that the leaks were caused by at least two detonations with "several hundred kilos" of explosives.

According to German Federal Government circles, photos taken by the Federal Police with the support of the navy show a leak 8 metres (26 ft) long, which could only be the result of explosives.

In the Swedish exclusive economic zone two technogenic (artificial) craters with a depth of 3 to 5 metres (9.8 to 16.4 ft) were found on the seabed at a distance of about 248 metres (814 ft) from each other, with pipeline debris located up to 250 metres (820 ft) away from the explosion sites.

On 18 November 2022, Swedish authorities announced that remains of explosives were found at the site of the leaks, and confirmed that the incident was the result of sabotage.

On 23 February 2023 explosives expert David Domjahn from the Karlsruhe Institute of Technology stated that the four Richter scale tremors would each have to have been caused by 300–400-kilogram (660–880 lb) C-4 explosive and ruled out the use of shaped charges.

On 21 June 2023, underwater drone footage obtained in a collaboration between German RTL, French Libération, Danish Ekstra Bladet and TV 2 from the southernmost sabotage site was published along with an analysis. The ruptured NS2 pipeline was filmed at a depth of 75 metres (246 ft). The steel part of the pipe had been severed with a cut that was clean except for a small indentation with the two separated pipe ends being 5 metres (16 ft) apart in a large crater. A named demolitions expert formerly with Denmark's Engineer Regiment and with the Danish Defence Intelligence Service argued that the steel was cut with a shaped charge using just a few kilograms of high detonation velocity explosives. His opinion was shared by an unnamed French demolitions expert still in active duty. Two Danish engineers with expertise in pipeline construction argued that the highly pressurised gas released by the explosion could have both bent the severed pipeline ends and formed the crater in the seabed. The estimate that just a few kilograms of explosives were used at the southernmost site with its 2.3 Richter scale tremor contrasts the 2.1 Richter scale tremor from the three other explosions and is not consistent with the interpretation of the Richter scale tremors that the four explosions were caused by "several hundred kilos" of explosives.

On 2 October 2022, Nancy Faeser, German Minister of the Interior and Community, announced that Germany, Denmark and Sweden intend to form a joint investigation team to investigate these seeming acts of sabotage.

On 14 October, Russia's foreign ministry summoned German, Danish and Swedish envoys to express "bewilderment" over the exclusion of Russian experts from investigations and protesting reported participation of the United States, saying that Russia would not recognise any "pseudo-results" without the involvement of its own experts.

Also on 14 October, the Swedish prosecutor announced that Sweden would not set up a joint investigation team with Denmark and Germany because that would transfer information related to Swedish national security. German public broadcaster ARD also reported that Denmark had rejected a joint investigation team.

Out of the three separate investigations carried out by Germany, Sweden and Denmark, the latter two were closed without publicly assigned responsibility for the damage in February 2024.

The day after the leaks occurred, the Swedish Police Authority opened an investigation of the incident, calling it "major sabotage". The investigation is conducted in cooperation with other relevant authorities as well as the Swedish Security Service. A similar investigation was opened in Denmark. The two nations were in close contact, and had also been in contact with other countries in the Baltic region and NATO. Because it happened within international waters (not part of any nation's territorial sea, although within the Danish and Swedish economic zones), neither the Danish Prime Minister nor the Swedish Prime Minister regarded it as an attack on their nation.

On 3 October 2022 a Foreign Policy columnist reported that Russia was dispatching naval vessels to join Swedish and Danish maritime experts at the leak sites. Foreign Policy reasoned that since the pipelines are Russian-state owned and since the sabotage is not considered a military attack, investigations may be complicated by Russian involvement. Moscow demanded to be part of the investigations conducted by Denmark and Sweden, but both countries refused, telling Russia to conduct its own investigations.

On 6 October, the Swedish Security Service said its preliminary investigations in the Swedish exclusive economic zone showed extensive damage and they "found evidence of detonations", strengthening "the suspicions of serious sabotage". On 18 October, the Swedish newspaper Expressen released photos it had commissioned of the Nord Stream 1 damage, showing at least 50 metres (160 ft) of pipe missing from its trench, as well as steel debris around the site.

On 18 October the Copenhagen Police Department stated that it and the Danish Security and Intelligence Service (PET) with support from the Danish Defence had determined that the pipelines had been extensively damaged by powerful explosions in the Danish exclusive economic zone and that consequently the police and PET would investigate the incidents.

On 18 November, the Swedish Security Service concluded that the incident was an act of "gross sabotage", stating that traces of explosives were found on the pipes.

On 4 April 2023 a press release from the Swedish prosecutor stated that the "incident had apparently become a game plan for attempts at manipulation. This speculation is nothing that will affect the investigation which is based on the facts and the information from analyses, crime scene investigations and collaboration with authorities in Sweden and other countries".

On 27 April 2023, the Danish Defence Command confirmed that six Russian navy ships including the SS-750 salvage ship able to launch a mini-submarine were operating in the area four days before the explosion.

On 14 June 2023, the senior prosecutor for the Swedish Security Service said that there is a strengthened suspicion that a state is behind the sabotage and that he believes it will be possible to determine who is responsible.

Both Sweden and Denmark closed their investigations into the incident in February 2024 without assigning responsibility. Swedish authorities cited the lack of jurisdiction while the Danish ones said that there was no basis for pursuing a criminal case.

On 10 October, the German Public Prosecutor General launched an investigation into suspected intentional causing of an explosion and anti-constitutional sabotage. The procedure is directed against unknown persons. According to the federal authority, it is responsible because it was a serious violent attack on national energy supply, likely to impair Germany's external and internal security. The Federal Criminal Police Office and the Federal Police were commissioned to investigate. The Federal Police had already started an investigative mission with assistance from the German Navy. Investigators took photos with a Navy underwater drone that showed a leak 8 metres (26 ft) long. This, it was said in government circles, could only have been caused by explosives.

On 15 October, the left-wing German party Die Linke made a parliamentary inquiry to the government. The German government claimed that no on-site investigation had taken place yet, and refused to disclose information about the presence of NATO or Russian ships near Bornholm on the day of the presumed sabotage, citing state secret.

On 2 June 2023, German police conducted a search of a flat near the Polish border and interviewed a woman whose 26-year-old male partner, a Ukrainian national who has returned to Ukraine, was named as a suspect in the investigation. A 50-foot sailing yacht named Andromeda, operated by the suspect, was reportedly near the site of two of the three explosions in the days before they occurred. DNA samples were taken, and traces of military explosives were found on Andromeda. The explosive residue on Andromeda matched residue found on the pipeline.

On 17 July 2024, the German government refused to publish the preliminary results of the investigation after the Alternative für Deutschland (AFD) party asked for it. AFD also asked the Bundestag about the possible involvement of American intelligence services or Ukraine in the attack on the pipelines, receiving the answer: "after careful consideration, the Federal Government has come to the conclusion that the question cannot be answered for reasons of public interest".

In August 2024 media reported that in June German authorities issued a European arrest warrant for a Ukrainian national living near Warsaw suspected of having used the yacht Andromeda together with two others to sabotage the Nord Stream pipeline.

On the news of Germany having issued an arrest warrant deputy government spokesperson Wolfgang Büchner said that the investigations are conducted in accordance with the law and that they have "top priority". The spokesperson added that the arrest warrant would not change "the fact that Russia is waging an illegal war of aggression against Ukraine" and that Germany's "support for Ukraine would remain steadfast".

Der Spiegel reported that seven days after the Federal Prosecutor General had sent his arrest warrant to Poland, the suspect reached Ukraine in a vehicle with diplomatic plates, used by the Ukrainian embassy in Warsaw.

According to Polish Rzeczpospolita the arrest warrant from Germany was received by Poland's National Public Prosecutor's Office on 21 June 2024 and on 24 June it was received by the District Prosecutor's Office in Warsaw. Nevertheless, on 6 July the suspect crossed the border into Ukraine.

The National Public Prosecutor's Office has stated that the German authorities created the arrest warrant without entering the suspect's information in the Schengen Information System (SIS II), allowing the suspect to cross the border without being arrested. The Wall Street Journal subsequently reported both that the German authorities denied making the procedural error and that the Polish Internal Security Agency was tasked with handling the arrest but did not execute the warrant.

A spokesperson from the Warsaw District Prosecutor's Office explained that no detention actions were taken and that instead secret, operational actions including surveillance of the suspect's home address were taken.

The Wall Street Journal reported that in early July the Polish government refused a government request from Germany to execute the arrest warrant, straining the relations between the two countries.

On 6 June 2023, The Washington Post reported that an intelligence agency of an unnamed European "close ally" had notified the CIA of a Ukrainian military plan for a covert attack on the pipeline. The plan was to be carried out by a team of divers reporting to Gen. Valery Zaluzhny, commander-in-chief of the Ukrainian armed forces, but the Post did not report any evidence that it had been put into action. The US reportedly learned of the plan three months before the destruction of the pipeline, and shared the intelligence with Germany and other allies. Communications from the unnamed European ally were included in the Discord document leak allegedly perpetrated by USAF Airman Jack Teixeira. A day after the Post's report, the Ukrainian president rejected allegations that Ukraine had destroyed the pipeline. Zaluzhny later denied to the Washington Post any involvement in the sabotage.

On 13 June, Dutch public broadcaster NOS reported that MIVD, Dutch military intelligence, was the agency that had originally alerted the CIA to the alleged Ukrainian plan.

On 17 February 2023, Russia formally submitted a proposal to the Security Council of the United Nations calling for an investigation into the Nord Stream sabotage, and reiterated its request on 20 February 2023.

On 24 March 2023, Kremlin spokesperson Dmitry Peskov stated that Denmark had invited the Russian-controlled operator of the Nord Stream 2 pipeline to help salvage an unidentified object found close to the pipelines, according to the source. This new development had been interpreted as a positive sign by Russia as it demands transparency during the investigation. At the centre of interest is a tubular object protruding from the seabed in the vicinity of the pipeline. Nord Stream is attempting to salvage this object for further investigation. The blasts are still unexplained but Russia blames the UK and the US for the sabotage.

On 27 March 2023, a UN Security Council motion by Russia for an independent international inquiry into the sabotage failed, with only China and Brazil supporting the motion, while the remaining 12 council members abstained.

CNN reported that European security officials observed Russian Navy support ships nearby where the leaks later occurred on 26 and 27 September. One week prior, Russian submarines were also observed nearby.

In September 2022, the former head of Germany's Federal Intelligence Service (BND), Gerhard Schindler, alleged that Russia sabotaged the gas pipelines to justify their halting of gas supplies prior to the explosion and said Russia's "halt in gas supplies can now be justified simply by pointing to the defective pipelines, without having to advance alleged turbine problems or other unconvincing arguments for breaking supply contracts.”

Finland's national public broadcasting company Yle compared the incident to the two explosions on a gas pipeline in North Ossetia in January 2006, which were caused by remote-controlled military-grade charges. The explosions halted Russian gas supply to Georgia after the country had started seeking NATO membership.

In December 2022, The Washington Post reported that after months of investigation, there was so far no conclusive evidence that Russia was behind the attack, and numerous European and US officials privately said that Russia may not be to blame after all. Others who still considered Russia a prime suspect said positively attributing the attack — to any country — may be impossible.

On 25 March 2023 T-Online reported on Russian naval activity near the Nord Steam pipelines just a few days before the explosions. On 19 September the Russian Baltic Fleet began maneuvers involving vessels and 313th Spetsnaz Special Forces frogmen out of the Baltiysk naval base. On 21 September the SS-750 salvage ship, which is designed for specialized underwater operations and able to launch the AS-26 Priz-class mini-submarine left Baltiysk with its AIS inactive. Analysis of satellite imagery and AIS-data indicate that the following day SS-750 was operating in the area together with five other Russian naval vessels including the rescue tugs SB-123 and Alexander Frolov that are capable of lowering into the sea objects weighing hundreds of kilograms such as mines and other explosive devices. Also in March the Danish and the Norwegian engineering newspapers Ingeniøren and Teknisk Ukeblad cited a named lieutenant commander of the Danish navy and analyst at the Royal Danish Defence College for reasoning that the sabotage used several hundreds of kilograms of explosives likely in the form of a naval bottom mine with 500 kilograms (1,100 lb) of explosives. T-Online additionally reported that on 22 September when the six Russian navy ships were operating in the area a Danish navy patrol boat and Swedish navy and air force were also present.

On 18 April 2023, Danish newspaper Dagbladet Information cited a statement from the Danish Defence Command obtained via a freedom of information law request. According to this statement a Danish navy vessel took 112 military intelligence relevant photos of Russian vessels in the relevant area in September 2022, four days before the explosions. On 27 April 2023 the Defence Command was again cited for a statement obtained by Information that confirmed T-Online's 25 March report that the SS-750 salvage ship was among six Russian navy ships operating in the area. The Danish navy vessel had left port on the evening of 21 September and arrived the next morning at what would become the sabotage site, a location it had not patrolled for years. With its AIS transponder inactive it patrolled the area for hours, joined first by a surveillance aircraft from the Swedish Air Force and later by a corvette from the Swedish Navy.

On 3 May 2023, an investigation by the Nordic public broadcasters DR, NRK, SVT, and Yle described "highly unusual" movements by ships thought to include Russian ships such as the tugboat SB-123, naval research vessel Sibiryakov, and another unspecified ship from the naval fleet. These ships had their transmitters turned off, and were reported to be in the area of the explosions between June up until 22 September 2022.

In May 2023, German newspaper Süddeutsche Zeitung reported that although the "[s]abotage last September has been linked to Russia", German investigators were sceptical as to whether the sabotage was carried out by Russian naval ships. Later in May, Der Spiegel newspaper wrote that a "false flag" operation by Russia is considered extremely unlikely "among people familiar with the process".

In June 2023, the Biden administration publicly deflected questions regarding the perpetrators while Biden administration officials conceded in private that no conclusive evidence points to Moscow being behind the sabotage.

In August 2023, Der Spiegel claimed that German investigators tend to believe that the Russian Navy was near the pipeline in the days before the attack because they wanted to patrol it for protection, as Russia may have received information, as did the CIA and Dutch intelligence, on a possible sabotage plan.

In April 2023, German Defense Minister Boris Pistorius cautioned against making premature accusations as to whom was behind the attack, suggesting that the alleged Ukrainian use of the 50-foot-sailing Yacht Andromeda might be a false flag operation.

In July 2023, RTL and n-tv reported that Andromeda, believed by German investigators to have played a role in the sabotage, had been rented by a company owned by a named woman originally from Uzbekistan, who holds a Russian and a Ukrainian passport, who is registered to an address in Kerch on the Russia annexed peninsula Crimea and who in June 2023 was posting to social media from Krasnodar in Russia. Commenting on these findings, member of the German Bundestag Roderich Kiesewetter said "Russia was involved in this attack".

In September 2023, Andreas Umland, analyst at the Stockholm Centre for Eastern European Studies, argued that the Andromeda was most likely a false flag created by Russia to implicate Ukraine. Umland argued that Russia may have attempted "to kill two birds with one stone" and not only avoid that Gazprom should pay compensation for undelivered gas, but also to threaten the support from allies to Ukraine in its defense against the Russian invasion of Ukraine. Umland further argued that Ukraine had no interest in sabotaging the already "dead" pipelines, since Ukraine had other priorities with a war in their country. According to Umland, Russia had the strongest motives for the sabotage. Further, Umland saw a pattern in Russia's behavior, because after Russian-controlled forces had shot down Malaysia Airlines Flight 17, Russia tried to frame Ukraine for this crime as well.

Also in September 2023, Poland's Secretary of State and coordinator of Poland's intelligence agencies Stanislaw Zaryn similarly told reporters that the Polish government alleged that Andromeda had links to Russian espionage, and that Russia was behind the attack and that "we have no evidence for this yacht's participation in the events". Without providing evidence, Zaryn went on to state that Andromeda's voyage had a "purely touristic character" with a crew "who were looking for fun" and where nobody seemed "to have anything close to military or sabotage-related training".

The Kremlin has strongly denied responsibility for the attack.

Details and sources above.

• 
  SS-750
• 
  AS-26
• 
  Alexander Frolov and SB-123
• 
  Sibiryakov

Russia first accused the United Kingdom, and later the United States, of being responsible for the sabotage. Der Spiegel reported that the United States Central Intelligence Agency (CIA) had warned the German government of possible sabotage to the pipelines weeks beforehand. The New York Times reported that the CIA had warned various European governments sometime in June.

At a United Nations Security Council meeting convened for the incident, Russian Federation representative Vasily Nebenzya suggested that the United States was involved in the pipeline damage. Deutsche Welle fact check concluded that the Russian claim "that an American helicopter was responsible for the gas leaks" is untenable and misleading. The helicopter never flew along the pipeline and the gas leak areas were at least 9 and 30 kilometres (5.6 and 18.6 mi) away, respectively, from its flight path.

On 8 February 2023, American investigative journalist Seymour Hersh published an article on his Substack page in which he alleged that the attack was ordered by the White House and carried out utilizing American and Norwegian assets by mining the pipelines in June during BALTOPS 2022 with a subsequent remote controlled detonation. The post relied on a single anonymous source, whom Hersh described as having "direct knowledge of the operational planning." The White House responded to the story by calling it "utterly false and complete fiction". The Norwegian Ministry of Foreign Affairs said that those allegations are "nonsense". Norwegian commentator Harald S. Klungtveit [no] challenged the accuracy of Hersh's claims, such as the notion that Alta-class minesweepers had participated in BALTOPS 2022, or that NATO Secretary General Jens Stoltenberg had been cooperating with US intelligence since the Vietnam War, when he was a teenager and fervently opposed to NATO. Subsequently, Hersh stated that the trail the German investigators were following on the "pro-Ukrainian group" that used a rented yacht was a false flag fabrication created by the CIA and fed to US and German outlets.

In October 2024, the Swiss newspaper Die Weltwoche wrote an article based on an interview given to Danish Politiken by the Christiansø port harbourmaster on the two-year-day of the Nord Stream pipelines sabotage. While the Danish harbourmaster dismissed the many sabotage accusations as conspiracy theories, the Swiss newspaper quoted him that he had sailed out to a fleet of US Navy ships sighted with inactive transponders near the position of the sabotage a few days before the sabotage happened and that the US fleet had requested him to turn around. The Swiss newspaper went on to note that the USS Kearsarge three months earlier had participated in BALTOPS 2022 that exercised unmanned underwater vehicles suitable for demining and other underwater operations, and that as such these vessels could transport explosive charges suitable for blowing the Nord Stream pipelines. The Swiss newspaper claimed this new information calls into question the assumption that a Ukrainian group was responsible for the sabotage and that investigations are continuing.

In March 2023, several international media outlets, citing anonymous sources, reported that a pro-Ukrainian group may have carried out the attack using the Andromeda, a 15.4-metre (50.6 ft) Cruiser 50 sailing yacht from Bavaria Yachtbau. According to these reports, investigators found explosive residues on the Andromeda and that it had been rented by six people with professionally forged passports, for a Polish company with two Ukrainian owners. The yacht is said have left Rostock on 6 September, briefly mooring at the port of Wiek and at the Danish island Christiansø, which is located 12 nautical miles (22 kilometres) from the explosion site.

Naval experts from Germany, Sweden and Denmark including lieutenant commander of the Danish navy and analyst at the Royal Danish Defence College J. Riber scoffed at the idea that a 50-foot sailing yacht could be used for such a spectacular attack. The naval experts point out that even with very skilled divers it would be extremely challenging for the crew of 6 to place at 262 feet (80 m) depth the explosives needed to create 2.5-Richter blasts. The Danish and the Norwegian engineering newspapers Ingeniøren and Teknisk Ukeblad cited lieutenant commander J. Riber, this time for several reasons why it is not credible that such a small vessel was used for the sabotage. The force of the explosion and the widely dispersed debris implies that several hundreds of kilograms of explosives were used, an amount that is impractical to transport with such a small sailboat. Secondly, it is surprising that traces of explosives were found on the yacht, since in this case clearly no homemade explosive device was used. Thirdly, accurately placing the explosives on the pipeline at 60–80 metres (200–260 ft) depth from a small surface vessel would be practically impossible. The skepticism was shared by a named former chief analyst of the Danish Defence Intelligence Service now senior analyst in the Danish think tank Europa. The naval officer speculated that a submarine was used to place the explosives and pointed out that a sonar-equipped submarine can, with relative ease, accurately place a naval bottom mine with 500 kilograms (1,100 lb) of explosives.

As of April 2023, the yacht was being kept in a German dry dock for investigation.

In April 2023, German law enforcement officials suspected that the yacht Andromeda had been a decoy with other vessels actually used for the attack, consistent with the view of naval experts from Germany, Sweden and Denmark that the Andromeda was unsuitable for the sabotage. As deputy chairman of the Parliamentary Oversight Panel colonel (retired) Roderich Kiesewetter was briefed by intelligence officials on the Andromeda investigation and came to believe that nothing had been communicated from the investigation because the "evidence is far too thin."

A joint report by The Washington Post and Der Spiegel released in November 2023 accused a named, former colonel in Ukraine's Special Operations Forces of coordinating the Nord Stream pipeline attack with the yacht Andromeda and a group of Ukrainian saboteurs, an accusation that the former colonel has described as Russian disinformation.

On 14 August 2024, The Wall Street Journal reported that the sabotage was carried out by a small Ukrainian team led by Zaluzhniy; the plan was also initially approved by Zelenskyy, according to the publication, who then unsuccessfully tried to call it off after the CIA learned of the plan and requested Zelenskyy to not proceed with the operation. As ambassador to the United Kingdom Zaluzhniy has in writing denied the allegations calling them a mere provocation. A senior official of the Security Service of Ukraine also denied his government's involvement and reiterated that Zelensky did not approve the implementation of any such actions on the territory of third countries and did not issue relevant orders.

President of Ukraine Volodymyr Zelenskyy has denied his country was behind the sabotage. Ukrainian presidential advisor Mykhailo Podolyak has also denied that Ukraine was behind the sabotage and instead blamed it on Russia.

According to a European lawmaker briefed in late 2022 last year by his country's main foreign intelligence service, investigators had been gathering information about an estimated 45 "ghost ships" whose location transponders were not on or were not working when they passed through the area, possibly to cloak their movements. The lawmaker was also told that more than 450 kilograms (1,000 lb) of "military grade" explosives were used by the perpetrators.

On 27 September 2022, European gas prices jumped 12 percent after news spread of the damaged pipelines, despite the fact that Nord Stream 1 had not delivered gas since August and Nord Stream 2 had never gone into service.

The Royal Danish Navy and Swedish Coast Guard sent ships to monitor the discharge and to establish an exclusion zone of 5 nautical miles (9.3 km; 5.8 mi) around the southernmost leak, and another of 7 nautical miles (13 km; 8.1 mi) around the other three, to keep other vessels away from danger. Two of the ships were the Swedish Amfitrite and the Danish Absalon, which are specially designed to operate in contaminated environments such as gas clouds. The US destroyer Paul Ignatius also contributed to maintaining the exclusion zone. Vessels could lose buoyancy if they enter the gas plumes, and there might be a risk of leaked gas igniting over the water and in the air, but there were no risks associated with the leaks outside the exclusion zones.

After the leaks, Norwegian authorities increased the security around their gas and oil infrastructure. As of 29 September 2022, eastward flow of gas from Germany to Poland through the Yamal–Europe pipeline was stable, as was transmission through Ukraine as of 2 October 2022, although concerns remained that Russia may introduce "sanctions against Ukraine's Naftogaz [...] that could prohibit Gazprom from paying Ukraine transit fees [... that] could end Russian gas flows to Europe via the country."

On 5 October, Nord Stream 2 AG reported that Gazprom had begun pulling gas back out of the undamaged pipe for consumption in Saint Petersburg, reducing pipe pressure. Infrastructure in the North Sea was being inspected for anomalies.

On 11 January 2023, EU and NATO announced the creation of a task force on making their critical infrastructure more resilient to potential threats.

The leaks only affected the environment in the area where the gas plumes in the water column were located. A greater effect is likely to be the climate impact caused by the emission of 150 thousand tonnes (330 million pounds) of methane, a potent greenhouse gas. The released volume is approximately 0.25% of the annual capacity of the pipelines, an amount nearly equal to the total release from all other sources of methane in a full year across Sweden. The leaks caused Sweden's emissions to increase rather than decrease, risking an EU fine.

A Danish official said these Nord Stream gas leaks could emit a CO₂ equivalent of 14.6 million tonnes (32 billion pounds), similar to one third of Denmark's total annual greenhouse gas emissions.

The methane emissions from the leaks are equal to a few days of the emissions from regular fossil fuel production, and one third of the daily emissions from agriculture. However, the leaks set a record as the single largest discharge of methane, dwarfing all previously known leaks, such as the Aliso Canyon gas leak.

A weather station in Norway logged an unprecedented 400 parts per billion (ppb) increase from a base level of 1800 ppb. Equipment measured no increase in atmospheric methane at Bornholm.

Scientists from several European countries have analyzed the impact on marine ecosystems. The shockwave is stated to have killed marine life within a radius of 4 kilometres (2.5 mi) and damaged the hearing of animals within 50 kilometres (31 mi). An estimated 250,000 tonnes (550 million pounds) of seafloor sediment containing lead and tributyltin used in anti-fouling paint have been lifted up. Additionally, the area is contaminated from the dumping of ammunitions and chemical weapons.

On 27 September 2022, Nord Stream AG, the operator of Nord Stream, said it was impossible to estimate when the infrastructure would be repaired. German authorities stated that unless they were rapidly repaired, the three damaged lines, both lines in Nord Stream 1 and line A in Nord Stream 2, were unlikely to ever become operational again due to corrosion caused by sea water. The Washington Post reported that the incidents are likely to put a permanent end to both Nord Stream projects.

According to engineers, possible methods for the repair of the pipeline would include full-scale replacement of pipe segments and clamping of damaged sections. If carried out, repairs would be expected to last several months.

In February 2023, The Times reported that Russia had begun estimating repair costs, put at about $500 million.

The bombings and subsequent underwater gas leaks resulted in reactions from a range of countries.

The day after the attack, the Prime Minister of Denmark Mette Frederiksen called the explosions deliberate and the leaks sabotage, while cautioning that it was not an attack on Denmark as they occurred in international waters.

In late 2022 August Hanning who until 2005 headed Germany's Federal Intelligence Service, said that Russia, Ukraine, Poland and Britain had a plausible interest in disabling the pipelines, as well as the US. In August 2024 Hanning went on to say that he believes that there was an agreement between Zelensky and the Polish president Andrzej Duda to sabotage Nord Stream.

In August 2023, Roderich Kiesewetter, a member of the German Bundestag, tweeted that Russia must have been involved in the attack.

The day after the attack, in a speech during the opening of Baltic Pipe, Prime Minister of Poland Mateusz Morawiecki called the leaks sabotage: "Today we faced an act of sabotage, we don't know all the details of what happened, but we see clearly that it's an act of sabotage related to the next step of escalation of the situation in Ukraine".

In a widely shared post on Twitter, Polish MEP and former foreign affairs and defence minister Radek Sikorski stated simply, "Thank you, USA", next to a photo of bubbling water above the pipeline damage. Hours later he followed up with a tweet that Ukraine and the Baltic states had opposed Nord Stream's construction for 20 years and tagged Russia's Ministry of Foreign Affairs: "Someone, @MFA_Russia, did a special maintenance operation." The following day Sikorski stated that also Poland had been opposed to Nord Stream and that its sabotage was good for Poland and recalled US President Joe Biden's words: "If Russia invades ... again, there will no longer be a Nord Stream 2. We will bring an end to it" and went on to clarify that his working hypotheses regarding the motives and ability to perform the sabotage were of his own making. Sikorski's post was criticized by many politicians and government officials. Polish government spokesman Piotr Müller said it was harmful and served Russian propaganda. US State Department spokesman Ned Price characterized the idea of US involvement in the pipeline damage as "preposterous". Der Spiegel commented that Nord Stream 2 was already stopped entirely without explosives two days before Russia invaded Ukraine, and that exactly what Biden and Scholz had said would happen already had happened before the sabotage. Sikorski deleted first the original and then all follow-up tweets several days later.

In August 2024 after it became publicly known that Poland had failed to execute Germany's arrest warrant for a Nord Stream sabotage suspect prime minister of Poland Donald Tusk tweeted: "To all the initiators and patrons of Nord Stream 1 and 2. The only thing you should do today about it is apologise and keep quiet."

The day after the attack, the Kremlin said that it did not rule out sabotage as a reason for the damage to the Nord Stream pipelines. Dmitry Peskov, the Kremlin spokesman, said: "We cannot rule out any possibility right now. Obviously, there is some sort of destruction of the pipe. Before the results of the investigation, it is impossible to rule out any option." On 29 September, Russian President Vladimir Putin called the attack on the pipeline "an unprecedented act of international terrorism". On 2 February 2023, Russian foreign minister Sergei Lavrov said on Russian state television the US had direct involvement in the explosions intended to help preserve US global dominance.

The day after the attack, Sweden's Prime Minister Magdalena Andersson said that it likely was sabotage and also mentioned the detonations.

A day after the attack, adviser to Ukraine's President Zelenskyy Mykhailo Podolyak blamed Russia, alleging their intent "to destabilize economic situation in Europe and cause pre-winter panic."

On 12 April 2023, former US President Donald Trump, when asked who carried out the sabotage, said, "I don't want to get our country in trouble, so I won't answer it. But I can tell you who it wasn't was Russia." According to Washington Post, Trump "suggests that he knows something, but it’s more likely just part of his effort to blame Biden for the war in Ukraine".

A day after the attack the president of the European Commission, Ursula von der Leyen, wrote on Twitter that "Any deliberate disruption of active European energy infrastructure is unacceptable & will lead to the strongest possible response."

The following day EU's foreign policy chief Josep Borrell said: "Any deliberate disruption of European energy infrastructure is utterly unacceptable and will be met with a robust and united response".

Two days after the attack Secretary-General Jens Stoltenberg of NATO said the leaks were acts of sabotage and that he had discussed the protection of critical infrastructure within NATO with the Defence Minister of Denmark Morten Bødskov.

• 2022 Urengoy–Pomary–Uzhhorod pipeline explosion
• 2006 Russia–Georgia energy crisis induced by pipeline sabotage