03 Aug The Monaco Bombing: Targeted Threat in a Highly Secure Environment

Key Judgements

• The attack on Ukrainian-born businessman Vadym Yermolaiev demonstrates the limits, rather than the failure, of Monaco’s highly secure environment against a deliberately targeted operation. Its extensive security infrastructure and substantial police presence enabled rapid reconstruction of the attack but did not prevent the reported surveillance and preparation beforehand. 
• The critical protective-intelligence challenge was identifying that Yermolaiev faced an emerging physical threat despite the absence of a known specific warning. His sanctions, commercial and family-linked exposures presented several plausible areas of risk, but none has yet been established as the motive; alleged attacker Anastasiia Berezovska’s reported surveillance remains the clearest publicly identified indication of escalation before the attack.
• The Monaco bombing was likely an organised operation extending beyond Berezovska. The reported involvement of a serving Ukrainian intelligence officer and a former security-service officer indicates wider coordination but does not establish whether they acted independently or under higher direction; the motive for targeting Yermolaiev remains unresolved. 

Objective

To assess what the 29 June 2026 bombing targeting Vadym Yermolaiev in Monaco reveals about the limits of environmental security, the challenge of detecting escalation in an already exposed principal’s threat profile, and the organisation behind the attack.

Context

On 29 June 2026, an explosive device detonated outside Yermolaiev’s Monaco residence as he, his partner and their 13-year-old son approached. His partner sustained the most severe injuries, losing both legs whilst Yermolaiev suffered burns and shrapnel wounds and their son sustained less serious injuries. The attack was exceptional in a principality renowned for low violent crime, extensive surveillance and a concentration of wealthy international residents.

Investigators identified Anastasiia Berezovska, a 39-year-old Ukrainian national resident in Germany, as the alleged perpetrator. She reportedly made repeated surveillance visits to Yermolaiev’s residence, including while disguised as a man, before placing and remotely detonating the explosive device. She then crossed into France on foot and travelled through several European states. Monaco investigators assessed that she probably did not act alone.

Berezovska returned to Ukraine on 1 July and was killed near Kyiv on 3 July. Ukrainian authorities detained Vladyslav Reut, a serving Ukrainian intelligence (HUR) officer, and Vitalii Zhykovych, a former Security Service (SBU) officer, over her killing. Both subsequently provided investigators with detailed accounts of the Monaco operation. They described financing Berezovska’s travel and expenses, while Reut reportedly admitted assembling the electronic initiation unit used to trigger the explosive. Their testimony provides evidence of their involvement in the operation but does not establish motive or whether they acted independently or under instructions from others.

Yermolaiev’s profile included several factors relevant to his potential exposure. A wealthy businessman with extensive international commercial interests, he was sanctioned by Ukraine in 2023 over alleged Russia-linked business activity in occupied Crimea, which he denies. His son Artur was separately convicted in Estonia in April 2026 of leading a criminal organisation specialising in telephone fraud. Despite these factors, Monaco’s Minister of State said after the bombing that he was unaware of any specific threat against Yermolaiev beforehand.

Timeline

December 2023 — Ukraine sanctions Yermolaiev over alleged Russia-linked business activity.
30 April 2026 — Artur Yermolaiev is convicted in Estonia of leading a telephone-fraud criminal organisation.
29 June 2026 — Bomb detonates outside Yermolaiev’s Monaco residence.
1–3 July 2026 — Berezovska returns to Ukraine; Interpol issues a Red Notice; she is killed near Kyiv on 3 July.
9–10 July 2026 — Reut and Zhykovych are remanded over Berezovska’s killing.
14 July 2026 — Ukrainian investigative reporting links Reut and Zhykovych to the planning and support of the Monaco operation.

Analysis

The limits of a highly secure environment

The attack exposed the limits of Monaco’s highly secure environment against a deliberately targeted operation. Extensive surveillance and policing provided strong investigative visibility afterwards, helping identify Berezovska and reconstruct her movements, but did not provide sufficient warning to prevent the bombing. The case demonstrates that environmental security and protection against an individually targeted threat are not the same: an adversary able to conduct surveillance and plan accordingly presents a different challenge from the conventional risks that a low-crime, heavily policed environment is designed to mitigate. For those with elevated threat profiles in secure Western European jurisdictions, location remains an important layer of protection but cannot substitute for assessment of the risks specific to the individual and appropriate protective measures. 

Detecting Escalation, Not Simply Exposure

Yermolaiev’s underlying exposure was visible before the bombing. His wealth and commercial profile carried conventional high-net-worth security considerations, while his sanctions history and family-linked criminal exposure created additional vulnerabilities. However, none has been established as the reason he was targeted, making it difficult to determine what escalation would have looked like before the attack. Monaco’s Minister of State said he was unaware of any specific threat beforehand. Berezovska’s reported surveillance is therefore significant as the clearest pre-attack indicator identified in public reporting that Yermolaiev faced an emerging physical threat. Whether other warning indicators existed is currently unknown.

An Organised Operation, but Direction and Motive Remain Unresolved

The evidence increasingly points away from an attack conceived and executed by Berezovska alone. Investigative sources assess Reut and Zhykovych as organisers, with reported responsibility for financing, logistics and technical support. Reut was a serving HUR officer and Zhykovych a former SBU officer, but their professional affiliations alone do not establish official direction. Yermolaiev’s allegation that other HUR officers, including individuals close to current or former leadership, were involved keeps the possibility of a wider network relevant, but there is currently insufficient evidence to assess how far, if at all, responsibility extended beyond those already identified.  The absence of an established motive further limits attribution. Reporting that the operation may have shifted from kidnapping to killing Yermolaiev suggests the objective may have changed during the planning stage but does not explain why he was selected. Until the purpose of the operation is clearer, Yermolaiev’s sanctions history, commercial interests and family-linked criminal exposure remain plausible lines of inquiry rather than explanations for the attack.

Protective Security Implications

The Monaco bombing reinforces the value of intelligence-led protection alongside strong environmental security. Monaco reduced general risk and proved highly useful in reconstructing the attack; neither advantage removed a threat already focused on a specific target. For protective-security providers, the case places emphasis not simply on identifying existing exposure, but on detecting changes that may indicate a more immediate risk. The failed attack also leaves a residual concern: with the motive and those ultimately behind it still unidentified, it cannot be assumed that the intent to target Yermolaiev ended with the removal or detention of known participants.