Arson at Keir Starmer’s home: what is known about the suspects?

North London Fires: Police Name Suspects

The fire at a property owned by UK Prime Minister Keir Starmer occurred on May 12, 2025. No one was injured in the incident. Starmer does not reside at the property, as it is rented out; he currently lives with his family at 10 Downing Street during his premiership.

The day after the fire, authorities announced the arrest of 21-year-old Ukrainian national Roman Lavrynovych, who is also accused of three other arson attacks that occurred the previous week: a car was set on fire in the Kentish Town area of North London, the blaze at Keir Starmer’s private residence, and another building nearby was also targeted. Later, on May 17, Stanislav Karpiuk was detained — a Romanian citizen born in Ukraine. The third suspect is a 34-year-old man, Petro Pochynok.

Roman Lavrynovych: Journey to the UK and the Search for Work via Telegram

Roman is originally from Pniv, Nadvirna District, Ivano-Frankivsk Region. According to Lavrynovych’s posts on social media, he arrived in the United Kingdom in March 2022, after the start of Russia’s full-scale invasion. He then began actively looking for a job — something he frequently wrote about in London-based groups focused on job opportunities for migrants — and took occasional jobs in the food service industry. He also attempted to obtain a fitness trainer certificate and has a modeling portfolio. An analysis of his Telegram account revealed 254 recent messages he had posted in various groups, about half of which were inquiries about job or side gig opportunities.

Messages about job searching (1, 2, 3, 4, 5)

An analysis of the Telegram groups and channels Roman followed reveals a digital trail suggesting possible recruitment attempts by Russian operatives.

Roman likely gambled online — his email address, rom***@gmail.com, is registered on the casino website “1Win.” He is also subscribed to Telegram groups linked to the illegal trade of drugs and alcohol, including:

• @darkm****b, @d****arketd, @va****dark_market — all are marked as VERIFIED DARKNET MARKET and styled to resemble legitimate dark web trading platforms. Such groups often serve as storefronts for order distribution, courier coordination, and the expansion of dealer networks.
• @df****gol — a channel openly advertising wholesale and retail alcohol sales, using emoji markers like “🔞🧊🎯” — commonly associated with semi-legal or counterfeit goods.
• @****e_cc_chat — a channel whose name recommends the possible presence of banking (CC) or payment data, commonly used in financial fraud schemes.

Participation in such groups — even passively — may, at the very least, indicate familiarity with shadow digital ecosystems and often suggests involvement in distributing illicit goods. Another portion of his Telegram subscriptions includes cryptocurrency chats showing signs of fake investment projects, manipulation, and bot-driven economies, where large numbers of fake accounts (bots) simulate real activity in chats, projects, or platforms. This tactic is used to create an illusion of popularity or hype.

• @cryptop****ker8, @crypto_gpt****, @tdn****at — they exploit “pump & dump” schemes, in which newcomers are encouraged to buy cheap tokens ahead of an artificially generated hype, only for those behind the scheme to sell off at a profit.
• @getfreed****, @ch****chat, @q****ven, @qatar2022**** — suspicious projects that exploit well-known brand names (for example, the World Cup in Qatar) to create an illusion of investment appeal.

Such communities may be used for money laundering, harvesting victims’ crypto wallets, or as gateways to “income schemes” that border on fraud or are externally coordinated operations.

The third category of groups where Roman Lavrynovych was active includes job announcement chats offering payment in rubles or cryptocurrency (1, 2, 3), often featuring anonymous listings with no specified address or employer. Roman is also subscribed to groups that use vague terms like “office,” “cash,” or “flexible schedule” without further details — typical markers of schemes involving cash handling, courier deliveries, or the laundering of illicit assets.

These Telegram groups and channels can serve as potential recruitment grounds for illegal operations. Proxy handlers from Russia often operate in such spaces, targeting vulnerable individuals willing to take on “any job.” This tactic has already been used in Ukraine, notably in the Kharkiv region, where the Security Service of Ukraine (SSU) detained a 17-year-old boy recruited by Russians via Telegram.

Similar cases have been reported across Europe, where Telegram has become a key tool for the GRU in recruiting so-called “one-time operatives” for sabotage missions. In EU countries, Russian recruiters primarily target migrants (including Ukrainian refugees), individuals with pro-Russian leanings but lacking deep ideological motivation, criminal elements, and people with questionable backgrounds.

Notably, the Telegram channel administered by the suspect himself features Russian songs, quotes, and posts from parties with Russian music (1, 2, 3, 4, 5).

Stanislav Karpiuk: What Is Known About the Second Suspect in the Arson Case in the UK?

Stanislav was born in Chernivtsi in 1998. He obtained Romanian citizenship, likely through family ties. In 2016, he received (1, 2) a certificate to work as a massage therapist, which he most likely used as his source of income while living in London.

In January 2024, Stanislav and his brother registered Vicontex (M & S Painters Ltd), which was involved in construction and painting work. In March 2024, Stanislav left the company as a legal entity partner. According to his LinkedIn profile, since February 2024, Stanislav has been working as a project director at Vicontex, while the company’s website lists him as a manager.

Technical data indicates that the suspect uses a Telegram account that appears to be set up as a “recruitment agency” under the name “unicorn staffing agency.” The unicorn-themed profile picture and name match those of American companies on Facebook and LinkedIn. However, this Telegram account has no connection to the United States.

The account is registered on a European server, most commonly used by users from Ukraine or central Russia users. This suggests the account was created in that region while trying to appear as part of a Western business. It follows a familiar pattern where fake “agencies” are made under false branding, often for recruitment into fraud or grey-area operations. The account looks like a legitimate Western company but originates from the post-Soviet region. Its goal is likely to conceal something or lure people in under the guise of employment or cooperation.

Like the previous suspect, Karpiuk has a modeling portfolio. He wrote that he aspires to become a world-class model. In the music video, Stanislav appears dressed as a clown, “Ya khochu tantsy-obnimantsy – MAN I FEST.” The video has been removed from YouTube and now remains only on the Russian platform Rutube, where it was published on December 24, 2023. The video for the Russian-language song was filmed in Chernivtsi.

Stanislav likely used (1, 2) Russian dating websites — his photo was found on teamo.ru. There is no direct link to Stanislav’s profile, but a cached version leads to the section: “Dating in Russia / in Moscow Region / in Bronnitsy / ages 18 to 25. Dating for Orthodox Christians in Bronnitsy, 18–25 years old.” His photo from 2016 was also found on the Russian social network VK (1, 2).

Despite living in the United Kingdom, Karpiuk’s digital footprint leans toward the Russian online sphere: Rutube, Russian dating platforms, and presence on social networks with Russian content, which, again, may serve as a potential vector for ideological exposure to Russian influence. Individuals like this are easier to recruit.

Petro Pochynok — possibly the third suspect in the arson case at Keir Starmer’s residence. What is known?

BBC and The Guardian have disclosed the name of the third suspect. He is Petro Pochynok, 34, originally from Chortkiv in The Ternopil Region.

BBC likely used a photo of Petro from his LinkedIn profile. However, upon review, the match is not exact. According to the account, from June 2013 to February 2016, Petro managed a clothing e-commerce store called “Xmode” and worked as a private entrepreneur selling clothes. He also had accounts on Russian social networks — VK (delete), VK2 — and an email address registered on the Russian platform mail.ru.

At the time of the incident involving Keir Starmer’s house, it appears that all three suspects may not have had stable sources of income and relied on informal employment channels. All three were indirectly embedded in the Russian information and cultural sphere.

The suspects are currently presumed innocent as the investigation continues. However, the available open-source data suggests a pattern: financial vulnerability, digital integration into the Russian-speaking environment, and a lack of stable identity.