OSINT Firm Bellingcat Traces Sensitive US Intelligence Documents Traced to Discord and 4chan

In recent days, the US Justice Department and Pentagon have begun investigating an apparent online leak of sensitive documents, including some marked "Top Secret." A portion of the documents focused on Russia's invasion of Ukraine, while others detailed analysis of potential UK policies on the South China Sea and the activities of a Houthi figure in Yemen.

The existence of these documents was first reported by the New York Times after Russian Telegram channels shared five photographed files relating to the invasion of Ukraine on April 5, at least one of which was found by Bellingcat to be crudely edited. The documents were traced back to Discord and 4chan, first appearing in Discord servers dedicated to the Minecraft game and a Filipino YouTube celebrity before spreading to 4chan and other platforms.

Bellingcat has seen evidence that some documents dated to January could have been posted online even earlier, although it is unclear exactly when. Bellingcat also spoke to three members of the Discord community where the images had been posted who claimed that many more documents had been shared across other Discord servers in recent months. The authenticity of the documents remains in question, with Ukrainian officials doubting their validity and suggesting Russian involvement in the leak.

The leaked documents found their way to various internet forums before being reported by pro-Russian Telegram channels and major media outlets. On April 5, the documents started propagating through pro-Russian Telegram channels, with the first version found by Bellingcat being on the Telegram channel “Donbass Devushka” at 9:29 pm (Ukraine time).

Just a couple of hours earlier, a user on 4chan had posted the first of eight messages in a thread on the Politically Incorrect (/pol/) board, three of which had attached images of seemingly similar but mostly different documents. These eight messages were made by the same anonymous user, as indicated by the same ID being used – CXWfLHRB.

There was only one image in common between the Telegram and 4chan posts: a map that showed a number of statistics, including the cumulative number of KIA (killed in action) soldiers on the Russian and Ukrainian sides through the course of the war. However, the numbers on these two sources differed, with the first source (4chan) showing more Russian losses than Ukrainian, and the second source (Donbass Devushka) the reverse.

A closer examination of the second image, with the much higher Ukrainian KIA numbers, that was posted on Telegram shows crude image manipulation. It seems that either the Donbass Devushka Telegram account or a previous source posted by this account altered the original image to paint the Ukrainian losses as heavier than in the original assessment.

On March 4, over a month before the Telegram and 4chan posts, 10 documents were posted in a Discord server called “Minecraft Earth Map.” After a brief spat with another person on the server about Minecraft Maps and the war in Ukraine, one of the Discord users replied, “here, have some leaked documents” – attaching 10 documents about Ukraine, some of which bore the “Top Secret” markings.

The user who shared these documents later claimed on Twitter that he found them posted by another user on a Discord server called WowMao, run by and for fans of a popular YouTuber of the same name. On March 1 and March 2, a WowMao user posted over 30 documents, many of which are marked “Top Secret,” on the server, therefore predating the Minecraft server posting.

However, the WowMao server may still not be the original source of these documents. Bellingcat spoke to members of a separate Discord community who claimed that other documents were leaked on a small, private Discord community named "Thug Shaker Central" but the community had been deleted and the existence of additional documents could not be verified.