The drone bomb that landed beside a Ukrainian Antonov An-124 at Leipzig/Halle Airport on August 4 was one of at least three aircraft in the plot, and investigators have recovered a second, different explosive from a field beside the airfield. The third drone turned up in Kabelsketal, a municipality that borders the airport’s western edge, on the evening of August 14. The next day, forensic technicians from the Federal Criminal Police Office found roughly 50 grams (1.8 ounces) of a substance they assess as hexogen, the military explosive also known as RDX.

NDR, WDR, and Süddeutsche Zeitung reported the finds on August 25, citing security sources, eleven days after the drone was pulled out of the grass. The investigators’ report, as the outlets quote it, says the perpetrators may have had “a far larger attack in mind than previously known” to the public. The federal prosecutor general, who holds the case, declined to comment.

Chancellor Friedrich Merz said the same day that the government will name who it believes is responsible shortly. “They will pay for this,” he said. In the three weeks DroneXL has covered this case, the physical evidence has grown from one dud bomb on the apron to three drones and two explosives.

Investigators Found The Third Drone Ten Days After The Bomb

The third drone lay in a field in Kabelsketal, in Saxony-Anhalt’s Saalekreis district, until the early evening of August 14. Federal Criminal Police Office technicians arrived the same day and returned on August 15, when they recovered about 50 grams of a substance that initial assessments identified as hexogen.

That timeline comes from tagesschau.de’s account of the joint NDR, WDR, and SZ investigation, and ZDFheute’s summary of the same reporting matches it. A spokeswoman for the federal prosecutor general declined to answer questions on Monday. The report does not say what the third drone carried, where it launched from, or what its role was, and the outlets say those points remain under investigation.

The find changes the count. When the first drone was found beside the An-124 late on August 4, the working picture was a single armed quadcopter and a second object that a DHL freighter hit during its go-around. Investigators now treat the Kabelsketal drone as the third aircraft, and the German outlets say more drones were used than the public had been told. What was known to investigators on August 15 reached the public on August 25.

The Second Drone Probably Went Through The DHL Freighter’s Engines

The second drone has never been found. Inspection of the DHL freighter that aborted its landing on August 4 showed tail damage consistent with a collision. Bird strike was ruled out. Investigators believe the drone went into the engines and was shredded, per the NDR, WDR, and SZ reporting.

The pilots saw an object about 30 centimeters (12 inches) across seconds before impact, ZDFheute reports from the same investigation, and the strike came at roughly the height of the airport fence at several hundred kilometers per hour. The freighter had been inbound from Marseille and diverted to Hanover. The Guardian, which carried the story in English, initially wrote that the plane was diverted to Marseille and corrected it on August 26.

The mothership theory DroneXL reported on August 10, a second drone relaying control signals and video for the armed one, now has hardware behind it. In Kursdorf, north of the airport, investigators found an antenna fixed to a tree along with other electronic parts they think were used to control the drones. Near it, close to where witnesses reported a loud bang on the day of the attack, they found a burnt patch of ground and charred metal parts.

Hexogen Is Not The Explosive That Was On The Apron Drone

The apron drone carried Semtex and PETN, plastic explosives, in a charge the Leipziger Volkszeitung put at up to 800 grams (1.8 pounds), a figure DroneXL reported on August 7 that remains single-source. The Kabelsketal find is a different compound in a far smaller quantity.

The reporting does not say whether the hexogen was mounted on the third drone. RDX is the base of C-4 and of most military demolition charges, and 50 grams is a booster-scale quantity rather than a warhead. Whether it was a booster for a larger charge that was never assembled, residue from one that was, or a payload in its own right is the question the report leaves open.

The rest of the case has been converging on Moscow. A US intelligence source told ABC News that the construction and explosives of the apron device were typical of Russia’s GRU, as DroneXL reported on Wednesday, and DNA on it matched a trace from the July 2024 DHL parcel-fire plot at the same airport. Security sources cited by the three German outlets suspect Russian intelligence in the August attack too. Moscow denies it. Berlin has stopped short of a formal attribution, which is what Merz says is coming.

The airport is the reason any of this happened. Leipzig/Halle is the cargo field NATO, the US military, and Ukraine’s Antonov Airlines use to move military supplies, and US officials told ABC News it has logged 18 drone incidents disrupting traffic since January. Days after the bomb, drones circled the Bundeswehr’s Patriot repair base at Mechernich in western Germany.

DroneXL’s Take

The detail I keep coming back to is not the hexogen. It is the third drone lying in a field beside a NATO cargo hub for ten days before anyone picked it up. My read of that is not that the attackers were sophisticated. It is that the airport’s outer perimeter, the farmland a few hundred meters past the fence, was nobody’s job on August 4, and it was still nobody’s job on August 13.

Investigators are owed the obvious point: the prosecutor general is running a live case against a state actor, and the ten-day gap between the find and the leak is probably deliberate. A second, different explosive is also the kind of detail you hold back to test what suspects say. None of that is a scandal.

The gap between August 4 and August 14 is a different matter. Everything Germany announced in the first week, the counter-drone radar on the old tower and the doubling of the federal counter-drone unit, looks inward from the fence. The third drone was outside it, in a field in another state, and it stayed there until someone walked across it. A radar on the tower would not have found it either. What finds a drone in a field is people on the ground with a search grid and a reason to look, and for ten days nobody had the reason.

That is the part American readers should sit with, because Leipzig is a US supply node as much as a German one. The Pentagon’s cargo moves through this field, the aircraft the first drone was meant for was Ukrainian, and the response so far is a German domestic policing story. Merz has promised findings and has not put a date on them. When they come, the number I’ll be watching for is not who did it, which the DNA and the US signature analysis have mostly answered, but how many launch sites the investigators can place, because that number is the difference between a plot that failed and a plot that stalled. I suspect it will be more than one.

Sources: tagesschau.de (NDR/WDR/SZ), ZDFheute, The Guardian

DroneXL uses automated tools to support research and source retrieval. All reporting and editorial perspectives are by Haye Kesteloo.