In late spring 2020, a source I knew to be reliable called me with a story. The Dutch government had hacked into Jared Kushner’s phone and monitored him as he accessed a Dubai-based bank account. What was odd, the source said, was that the money in the account—hundreds of millions of dollars—had come from a bank in Azerbaijan. Most importantly, Kushner appeared to have transferred significant amounts of money from the Dubai account to other individuals, including a warlord, a mercenary and a one-time hit man. The story sounded preposterous, I told my source. And yet.

Six months later, I found myself speaking with someone else about the UAE government and their use of mercenaries in conflicts around the Middle East and Africa when I asked, on a whim, whether they knew anything about Kushner and bank transfers from a UAE account. My acquaintance grew quiet. Then they replied, “Yes.”

Over the next four years, I came to learn that, sometime in late 2017, the Netherlands Defense Intelligence and Security Service (MIVD) made a startling discovery. A General Staff of the Armed Forces of the Russian Federation (GRU) operative, a dark web hacker specializing in stolen bank data, was traveling to the UK for an espionage mission. They reached out to the British government for permission to apprehend him when he arrived. The British agreed.

When the Russian national arrived in England, the Dutch informed him that he had two options: he could work for them against the GRU, or the British would arrest him. Once in UK government custody, the operative would be charged with espionage. If convicted, he would spend years in a British prison. The Russian chose to change his employer.