The Traitor as a Trump Card: Behind the Scenes of a Spy Exchange
The case of Alexandru Balan is one of the most telling examples of how a counterintelligence operation, criminal proceedings, and a spy exchange can converge into a single intelligence-political mechanism [1]. This is not just about a former high-ranking employee of the Information and Security Service (Romanian: Serviciul de Informații și Securitate, SIS – Transl.) of the Republic of Moldova accused of collaborating with the Belarusian KGB. We are talking about an individual who knew the security system from the inside (in particular, its vulnerabilities), had experience in counterintelligence, and possessed information about the personnel, the special service’s network of agents, and channels of cooperation with foreign partners. Ultimately, this individual was detained in Romania, extradited to Moldova, convicted in his home country, pardoned by President Maia Sandu, stripped of Moldovan citizenship, and sent to Belarus as part of a spy exchange.
A few words about the individual involved in this case. Alexandru Balan was born in 1978. In 2000, he graduated from the Academy of Economic Education in Chisinau, after which he immediately became an officer of the SIS. He served until 2023 in various positions, notably heading the Main Directorate of Counterintelligence [2]. In 2016 through 2019, he served as Deputy Director of the SIS and held the special rank of Colonel. Following a change in the SIS’ leadership, Alexandru Balan was sent into “honorable exile” as a liaison officer between the intelligence services, serving as a security advisor at Moldova’s Embassy in Ukraine. He worked in Kyiv until the summer of 2021 but remained there for another eight months after his assignment ended [3]. Having returned to Moldova, Alexandru Balan remained in the reserve for some time, and in November 2023, he was dismissed from service. According to some media reports, the reason for his dismissal was a traffic accident he caused while drunk. However, Alexandru Balan himself denied any involvement in the incident and even threatened legal action for defamation. After his dismissal from the SIS, he gave interviews as an expert on the activities of special services and participated in European security conferences [4].
What Is He Accused of?
The retired Colonel, who held dual citizenship (Moldova and Romania), was detained on September 8, 2025, at the airport in Timișoara. According to publicly available information, two parallel lines of investigation can be identified in this case: the Romanian and the Moldovan. In Romania, Alexandru Balan was detained on suspicion of treason for passing state secrets to foreign intelligence services. According to a Eurojust report [5], the suspect held at least two meetings in Budapest in 2024 and 2025 with officers of the Belarusian KGB, and the intelligence services of Romania, Poland, the Czech Republic, and Hungary participated in this counterintelligence operation.
At the same time, Czech counterintelligence reported that it had uncovered a Belarusian intelligence network operating in Europe, one of whose members was a former Deputy Director of Moldova’s Security and Intelligence Service. At the same time, the Czech Ministry of Foreign Affairs declared one of the employees of the Belarusian Embassy persona non grata for activities incompatible with diplomatic status (according to media reports, that was embassy advisor Mykola Dukhta). On the same day, at the request of the Polish Internal Security Agency, the Polish Ministry of Foreign Affairs “asked” a staff member of the Belarusian Embassy in Warsaw to leave the country.
It later became known that the main supervisor of the network was Vladimir Vorozhbitov, an officer of the Belarusian KGB. He was also in contact with another agent – Belarusian citizen Vladislav Nadeyko, who lived and worked in Poland, where he gathered information on political émigrés.
According to the findings of the Romanian Directorate for Investigating Organized Crime and Terrorism (DIICOT) [6], it was Alexander Balan’s meetings with Belarusian intelligence officers in Budapest that became a key element of the case. The investigation paid special attention to the covert methods used to maintain communication between members of the espionage network. Instead of the traditional exchange of emails, which could have been intercepted, they employed a “shared mailbox” system. Messages were not sent but stored in the “Drafts” folder, to which both parties had access. This method of communication significantly complicates the investigators’ work, as the emails do not actually pass through network servers as sent messages. One of Alexandru Balan’s email accounts – alvlapow@gmail.com – was deleted from an IP address in Belarus almost immediately after his arrest in Romania. During a search of the retired Colonel’s residence, a Blackview phone linked to this account was also found. The device was stored in a so-called Faraday cage, which blocks electromagnetic signals and prevents remote access to the gadget. The data on the device were additionally encrypted using the VeraCrypt program.
When analyzing the case of Alexandru Balan, it should be noted that the full body of evidence is not publicly available, as it reveals state secrets and counterintelligence operations conducted by special services of several countries. Based on the information currently available in the public domain, the following conclusions can be drawn.
First, Eurojust reported on the exchange of information and evidence between Romania, the Czech Republic, and Hungary, as well as the swift execution of European investigation orders [7]. This means that the case was not exclusively national in nature, but rather a coordinated international investigation.
Second, certain operational measures regarding the suspect were carried out by Romanian counterintelligence, and the arrest warrant was executed by DIICOT prosecutors. The operation took place under the auspices of Eurojust with the participation of special services of the Czech Republic, Hungary, and Poland, while the Moldovan SIS provided support during the final stage of the investigation.
Third, a closed-door court hearing took place in Moldova, and on April 15, 2026, Alexandru Balan pleaded guilty and requested that the case be heard under a simplified procedure. He was sentenced to one year and six months in prison and is also barred from holding public office for two and a half years.
Fourth, during a search of Alexandru Balan’s flat in Chisinau, law enforcement authorities discovered two classified documents, one of which was related to the SIS. This incident highlighted a problem with the protection of classified information, to which Alexandru Balan had gained access not as a current but as a former employee of the special services.
Fifth, the SIS likely had its suspicions about him earlier. Its current head, Alexandru Mustiace, stated that the SIS began to have doubts about Alexandru Balan’s behavior and his possible contacts with foreign intelligence services as early as 2022–2023. This was later confirmed by partners who documented the retired Colonel’s meetings with Belarusian citizens. Since 2019, Alexandru Balan has had no access to sensitive classified information and no longer posed a direct threat to the state, although the SIS continues to assess the extent of the compromise of the data to which he previously had access.
It is also worth mentioning earlier scandals in Alexandru Balan’s biography. Moldovan media reported that, on the one hand, he was involved in the suppression of anti-communist protests in 2009 [8], and on the other—allegedly helped Russian blogger Eduard Bagirov escape, whom the Moldovan prosecutor’s office suspected of participating in the organization of those protests [9].
What Did Alexandru Balan Himself Say?
The most interesting aspect of this case is the contrast between what Alexandru Balan said before the case was concluded and what happened later. As noted above, on April 15, 2026, he pleaded guilty in court and requested that the case be heard under a simplified procedure, which is why he received a relatively lenient sentence. This did not mean that all the circumstances of his possible collaboration with the Belarusian KGB were revealed, as part of the operational materials remained undisclosed.
Alexander Balan presented a different account – and, at the same time, his defense strategy – in an interview with the Romanian magazine Q Magazine while he was still in custody in Bucharest. In that conversation, Alexandru Balan did not describe himself as an agent of the Belarusian KGB, but as a former counterintelligence officer who had allegedly spent years fighting Russian influence in Moldova. He claimed that he had not worked for either the Russian or Belarusian intelligence services, and called the charges against him fabricated, false, or the result of actions by individuals with whom he had previously been in conflict. Alexandru Balan also acknowledged that Russian intelligence services are present in Romania in the economy, politics, and army, but did not link this to his own cooperation with them [10].
Alexandru Balan’s defense strategy was also based on references to his Romanian identity, Romanian citizenship, and pro-European views, with a hint that such a life path contradicts the claim that he was recruited by Moscow or Minsk.
Against the background of these statements, the manner in which Alexandru Balan was received after his pardon and handover to the Belarusian side as part of a “five-for-five” exchange appeared highly symbolic. There, the event was presented as the return of “one of their own”. Retired SIS Colonel Balan was greeted with flowers at the border with Poland by Deputy Head of the Investigative Directorate of the KGB of Belarus Alexander Tarasevich.
This incident was significant not only as part of a Belarusian media spectacle but also as a political signal. Belarusian authorities acted as if they were not taking back a random Moldovan citizen, but rather returning someone they considered part of their own security apparatus – or at least someone who had been working on behalf of Belarusian secret services. As Alexander Tarasevich stated, the exchange had been under discussion for about a year, and the KGB acted on the orders of the President of Belarus, who allegedly personally ordered the return of agents who had risked their lives and health while carrying out their missions.
Why Was He Released?
Alexandru Balan was not released because the charges against him had been dropped, but because he became part of a spy swap. President of Moldova Maia Sandu reported that two Moldovan citizens who worked for the SIS and were being held in Russia [11] were released in exchange for citizen of the RF Nina Popova [12] and Alexandru Balan. She explained that for Moldova, this was a win that cannot be measured by a simple mathematical equation: the state recovered two citizens who were carrying out tasks for it, while giving up two prisoners who were acting against Moldova’s interests.
The Importance of the Belarusian Element
Formally, in the case of Alexandru Balan, the most important entity identified by experts is the Belarusian KGB. It was with members of this intelligence agency that he met in Budapest in 2024–2025. Public reports did not mention that his direct contacts were officers of the Russian FSB or SVR. For this reason, it would be technically inaccurate to call Alexandru Balan a Russian agent. This, however, does not mean that the Russian element did not play a significant role in this case.
The KGB of Belarus maintains a post-Soviet model of a special service that combines the functions of counterintelligence and political police with operations abroad. Since 2020 – that is, following the mass protests in Belarus and the deepening of Minsk’s dependence on Moscow – Belarusian secret services have been cooperating even more closely with the FSB and SVR of the RF and may be supporting Russian operations in Europe [13].
In light of this, the characterization of Alexandru Balan as a “Russian agent” is politically understandable. Although he met in Budapest specifically with officials from the Belarusian KGB, the fact that Russian intelligence services were also involved in the exchange, and that two Moldovan officers were being held in Russia, indicates that the operation had not only a Belarusian but also a Belarusian-Russian dimension.
More Than Just Treason: The Belarusian KGB, Post-Soviet Intelligence Services, and the Logic of Exchanges
The case of Aleksandru Balan reveals much more than just an isolated instance of a former employee accused of treason. Above all, it has shown that the Belarusian KGB is not merely an instrument of internal repression against Aleksandr Lukashenko’s opposition, but also an active instrument of operations abroad[14].
Czech counterintelligence has pointed to the existence of a Belarusian intelligence network that has taken shape in Europe and exploited, in particular, the freedom of movement of diplomats within the Schengen Area. In this sense, the case of Alexandru Balan fits into a broader pattern of Minsk’s actions. Belarus not only supports Russia’s hybrid war on the continent but also conducts its own intelligence and influence operations, as well as recruits agents outside its own territory. This is particularly important in the context of Moldova, which remains one of the most critical battlegrounds in the rivalry between Russia and the West, while also being a state with security institutions burdened by a post-Soviet legacy.
The case of Alexandru Balan also highlights the particular vulnerability of post-Soviet states to the problem of former intelligence officers who, even after leaving the service, possess information of interest to foreign intelligence agencies.
However, the most paradoxical aspect of this story concerns his release. Alexandru Balan was convicted of disclosing state secrets, declared by the Moldovan state to be acting against its interests, and then pardoned and handed over to Belarus, as his extradition made it possible to repatriate Moldova’s own citizens. This demonstrates the typical, albeit cynical, logic of spy exchanges: a state may view a traitor not only as a defendant but also as a bargaining chip.
Volodymyr Palyyoda,
expert in international relations
Notes:
[1] According to experts, an intelligence-political mechanism is a set of institutions, tools, and procedures through which intelligence or counterintelligence data (relevant information about the enemy’s intentions, threats, and resources) is converted into specific administrative, diplomatic, and security decisions by the state.
[2] The SIS’ powers include intelligence and counterintelligence activities (including military counterintelligence), the protection of the constitutional order, counterterrorism, ensuring economic security, fighting organized crime, safeguarding state secrets, and ensuring information and cybersecurity.
[3] Given that the Russian and Belarusian Embassies remained operational in Kyiv until the start of Russia’s full-scale invasion of Ukraine in February 2022, it is reasonable to assume that Alexandru Balan may have been recruited while working at Moldova’s Embassy in Ukraine.
[4] On May 9, 2024, Alexandru Balan gave an extensive interview to the Ukrainian publication “Glavkom”, in which he positioned himself as a pro-European statesman, a patriot of Moldova, and a steadfast fighter against pro-Russian forces in the country. He spoke positively about the SIS’ cooperation with Ukraine’s intelligence services in addressing common challenges.
[5] Eurojust (the European Union Agency for Criminal Justice Cooperation) is an organization dedicated to judicial cooperation in criminal matters among the authorities of member states. Its headquarters are located in The Hague (Netherlands). Founded in 2002, it was established to improve the fight against serious cross-border and organized crime by promoting the coordination of investigative and prosecutorial activities.
[6] DIICOT – an acronym for Direcția de Investigare a Infracțiunilor de Criminalitate Organizată și Terorism. A Romanian law enforcement agency responsible for investigating cases related to organized crime, drug trafficking, cybercrime, financial crimes, terrorist crimes.
[7] The European Investigation Order is a mechanism established by EU legislation in 2014, through which a judge or magistrate in one EU member state can issue a binding request to law enforcement authorities in another member state to gather evidence to assist in a criminal investigation. The Order may authorize actions such as searches, wiretaps, surveillance, requests to courts for documents or records, and so on. The mechanism is in effect throughout the EU (with the exception of Denmark and Ireland).
[8] Anti-communist protests (also known as the “Brick Revolution”) began on April 7, 2009, following parliamentary elections won by the Communist Party of Moldova, which raised suspicions of fraud. The protests quickly escalated into mass riots, during which protesters stormed the Parliament building and the Presidential Administration. The events were dubbed the “Brick Revolution” because protesters used bricks to storm the buildings. President Vladimir Voronin accused Romania of organizing the riots. The protests had a significant impact on the country’s political situation, leading to a re-election and a change in government.
[9] Investigative authorities accused Eduard Bagirov of “actively engaging with the social sphere as a blogger and writer and, using mass manipulation techniques, taking an active part in the development and implementation of provocative measures aimed at undermining the pre- and post-electoral process.” On April 24, 2016, a Chisinau court sentenced Eduard Bagirov in absentia to five years in prison.
[10] For more details on this topic, see the article: “How Russian Intelligence Agencies Operate: Infiltration, Disinformation, Propaganda, and Hybrid Attacks” // https://igp.org.ua/publikacii/rozvidka-rosijskoї-federaciї-v-rumuniї/
[11] These individuals, detained by the FSB in Moscow in the summer of 2025, had arrived there using forged documents. Initially, they presented themselves as ordinary citizens recruited by Moldovan intelligence services to conduct intelligence activities. However, it was later established that both were SIS officers.
[12] Nina Popova, the wife of an officer of the Russian Federation’s Joint Peacekeeping Forces stationed in Transnistria, who was suspected of being a member of the GRU’s active-duty personnel. She was arrested on July 3, 2025, at the Chisinau airport a few days after the FSB detained two SIS officers from Moldova in Moscow.
[13] According to the specialized website Intelligence Online, the Belarusian KGB plays a significant role in Russia’s hybrid operations against Ukraine and countries of the European Union. Minsk effectively acts as a contractor for the FSB in recruiting Ukrainian citizens to carry out sabotage activities both in Ukraine and on EU territory. Such individuals are considered “convenient targets” because they can move relatively freely throughout Europe, and in case of failure, they can be used for propaganda purposes, particularly to undermine the West’s support for Ukraine.
[14] In October 2024, FSB Director Aleksandr Bortnikov stated at a meeting of the Council of Heads of Security and Special Services of the CIS that the KGB of Belarus had assisted Russian special services in identifying individuals involved “in the activities of pro-Ukrainian paramilitary groups based in EU countries”. Experts are especially interested in the role of Chief of the KGB of the Republic of Belarus Ivan Tertel, who is viewed as one of the key contacts in the broader context of the Russian-Ukrainian war. For instance, he was present at negotiations with the American side, where the lifting of sanctions against Belarus and the release of political prisoners were discussed. For more details on this topic, see the article: “The State Security Committee of the Republic of Belarus as the ‘Foundation’ of Aleksandr Lukashenko’s Regime” // https://igp.org.ua/publikacii/komitet-derzhavnoї-bezpeki-respubliki-bilorus/
