Poland’s School Attacks and the 764 Network: The Hypothesis to Test First

2026.10.10 Author: Robert Nogacki

A thirteen-year-old from Książki, a village near Wąbrzeźno in northern Poland, told a stranger he was playing with in an online game (according to the news portal o2.pl, on Roblox) that he had killed cats with a cleaver and was going to murder his classmates and teachers in a school corridor. The stranger was Swedish and took it seriously; through Interpol and the Polish police’s international cooperation bureau the information reached Wąbrzeźno overnight, and in the morning officers found a bayonet in the boy’s school bag. Nine days later, in the town of Ostrołęka, a nineteen-year-old stabbed nine people at his school and had a homemade explosive device in his backpack; the next morning, near Wyszków, a fifteen-year-old wearing a helmet with a camera on it killed a school caretaker. According to unofficial findings by o2.pl, the thirteen-year-old had a swastika carved into his arm and the fifteen-year-old a fascist symbol on his body. The police were right to deny the existence of an online “challenge.” There is, however, a hypothesis more serious than a challenge, and one that Polish official statements have not yet named: the 764 network and its European offshoots, which the FBI classifies as nihilistic violent extremism and which Canada has listed as a terrorist entity since December 2025. This article does not claim that 764 is behind the Polish attacks. It claims that this is the hypothesis to test first, because it changes the legal classification, the circle of suspects, and what investigators should be looking for in the seized phones. And it states the hypothesis publicly because the steps that follow from it are cheap and reversible, while omitting them is not.

What is known as of 10 October

On 7 October, Jakub Z., a final-year student at Vocational School Complex No. 4 in Ostrołęka, stabbed nine people: five students, two teachers and two bystanders. He had a homemade explosive device in his backpack. On 8 October, at a primary school in Leszczydół-Nowiny near Wyszków, a fifteen-year-old former pupil attacked three members of staff; a thirty-seven-year-old caretaker died, and the headmaster overpowered the attacker. Prime Minister Donald Tusk disclosed that the boy had been wearing a helmet with a camera and intended to film the attack. On 7 October, the same day as Ostrołęka, police in Sierpc detained a seventeen-year-old who had threatened an attack, and on 28 September, in Książki near Wąbrzeźno, a thirteen-year-old who had been planning killings at his own school. On 10 October, at an adult education school on Mińska Street in Warsaw, a twenty-one-year-old student stabbed three women she did not know. By Saturday morning the police had inspected close to fifty thousand institutions, logged 231 incidents and detained 76 people, mostly for threats and videos with knives. The thirteen-year-old from Książki, who admitted killing four cats over the summer and planning an attack on random people, was placed by a family court in a youth correctional centre.

The official position is cautious, and honest in its caution. On 9 October the National Police Headquarters announced that nothing indicated the existence of an online challenge referred to as “Bloody Friday.” The Ministry of the Interior (MSWiA) does not link the Ostrołęka, Wyszków and Sierpc investigations into a single operation, but in a statement to the news portal o2.pl it conceded that closed groups on Telegram and Discord propagating neo-Nazism, accelerationism and violence are the main source of radicalisation among Polish youth, and that the influence of extremist groups on the attackers is being examined. The spokesman for the special services confirmed that an outside inspiration, including a Russian one, is also being checked. A journalist at o2.pl established, unofficially and from four sources, that the thirteen-year-old had a swastika cut into his arm and the fifteen-year-old a fascist symbol on his body, that the Discord groups in which they radicalised numbered thousands of members, and that some of the posts were calques from Russian.

That is everything we know. The rest of this text is a hypothesis, built from what has been established in similar cases in the United States, Canada, the United Kingdom, Sweden, Spain and Italy.

The Blue Whale was a legend. 764 is a truth that looks like a legend

In 2016 and 2017 a story went around Europe about the “Blue Whale,” a game in which curators supposedly led teenagers to suicide over fifty days. Most of the story was moral panic; the kernel of truth was a handful of Russian convictions. Ten years later the situation has reversed. There is a network that does exactly what the legend attributed to the Whale, and more, and in Polish public debate it remains at the margin: a specialist piece on CyberDefence24 in January 2026, a few mentions in the press, and silence in the statements of the services.

The network is called 764. It was founded at the turn of 2020 and 2021 by a fifteen-year-old, Bradley Cadenhead of Stephenville, Texas, who took the name from the first three digits of his ZIP code and spun it off from an earlier sextortion network called CVLT. In 2023 a Texas state court sentenced Cadenhead to eighty years in prison. The network outlived him. Today “764” is a brand rather than an organisation: a collection of cells, channels and splinters (CVLT, No Lives Matter, Harm Nation and dozens of other names, changed after every arrest), embedded in a wider ecosystem known as “the Com,” a loose international community of teenagers and young adults that combines cybercrime, extortion and violence for its own sake.

The mechanism, described in dozens of American indictments, is repetitive. Contact is made where the children are: on Roblox, in Minecraft, on Discord. The conversation moves to closed channels on Discord and Telegram. The victim, most often a girl between ten and seventeen and often already in a mental health crisis, is manipulated into sending intimate material and then blackmailed with it into ever graver acts: self-harm with usernames or symbols cut into the skin as proof, cruelty to animals, harm to siblings, and in the most extreme cases suicide in front of a camera. The material goes into collections with which the perpetrators build status inside the network. After Nepal’s guilty plea, the federal prosecutor Jeanine Pirro put it in a sentence: in this world cruelty is currency and violence is entertainment.

The network’s standing in the world now looks like this. The FBI issued its first public warning in September 2023 (and another in September 2026, about a sharp increase in the network’s activity); in 2025 it was running more than 250 investigations across all fifty-five field offices; by April 2026 it spoke of more than 450 subjects. The US Department of Justice describes 764 as a network of nihilistic violent extremists seeking to destroy civilised society through the corruption and exploitation of the vulnerable; the term itself, coined by the FBI, has drawn criticism for overuse, but as applied to 764 it is not in dispute. On 10 December 2025 Canada became the first country to list 764 as a terrorist entity, alongside the Russian-language Maniac Murder Cult and the Terrorgram Collective. The sentences: Kyle Spitze, one of the earliest members, seventy-seven years (August 2026); Alexis Chavez, leader of the “8884” splinter, forty years (July 2026); Prasan Nepal, whom prosecutors call the leader of 764 and the gatekeeper of its inner circle, “764 Inferno,” pleaded guilty on 8 October 2026 and faces between fifteen and thirty years; his co-defendant Leonidas Varagiannis is in custody in Greece.

In Europe: in the United Kingdom, Cameron Finnigan of Horsham, a member of 764 from the autumn of 2023, was sentenced in January 2025 to six years for encouraging a girl to kill herself on camera “for him,” possessing a terrorist manual and indecent images of children; in his sentencing remarks the judge described a “terror week” announced in 764 channels for the end of March 2024. In Italy, in February 2025, police arrested a fifteen-year-old near Bolzano, a member of 764, on charges of membership of an association with terrorist aims, manufacturing explosives and possessing child abuse material; the last message he managed to send to the group said he had the police at the door; in the spring of 2026 Italy then went through four school cases in sixty-five days, discussed below. In Sweden, four cases have been known since 2024, including a fourteen-year-old with the handle Slain764, according to GNET an administrator of the network’s Swedish channels, who in 2024 stabbed a woman in her fifties and, two months later, an eighty-two-year-old man in Hässelby outside Stockholm, filming both attacks and circulating them; and a fourteen-year-old in Borås who stabbed a woman he did not know and explained that the network had been blackmailing him and his family. In September 2026 the district court in Umeå sentenced the eighteen-year-old “Chai”, who had remotely directed the Hässelby attacks, to ten and a half years in prison; the judgment is under appeal. In Spain, in July 2026, the Ertzaintza, the Mossos d’Esquadra and the Guardia Civil detained a seventeen-year-old regarded as the network’s main figure in the country, responsible for months of threats against schools and public offices. There are cases in Norway, Denmark, Germany and Finland.

From sextortion to the knife: the 2024 turn

For Polish investigators the most important thing is the evolution that researchers date to 2024. For its first three years 764 was an almost entirely online phenomenon. Then cells began demanding “real-life ops” from candidates: smashing windows, arson, beatings, stabbings, filmed as a condition of admission. The recruitment material of one cell, described by GNET in January 2026, lists these requirements in plain words. The Swedish stabbings, a Danish livestream of a member chasing passers-by with a knife, the burning of twenty-odd cars in Ängelholm in November 2025 announced as revenge for the arrest of a member: all of it belongs to this turn.

Two cases show the far end of the ladder. In August 2024 an eighteen-year-old in Eskişehir, Turkey, stabbed people outside a mosque while livestreaming, in a mask and helmet and a vest bearing a black sun. In January 2025 seventeen-year-old Solomon Henderson shot a fellow student dead at Antioch High School near Nashville and tried to stream the attack on the platform Kick; his manifesto, alongside passages plagiarised from earlier attackers, venerated figures from the 764 network known by their handles, among them the Swedish “slain” and “yegor,” that is, Yegor Krasnov, the founder of the Maniac Murder Cult.

That last name leads to the thread the Polish services call Russian. The Maniac Murder Cult (MKU, in Cyrillic М.К.У.) emerged around 2018 in Dnipro, Ukraine, spread into Russia, and its Russian-language manuals, including a text on edged weapons, circulate on Telegram in the same channels as the material of 764 and No Lives Matter. One of its leaders, a Georgian national named Michail Chkhikvishvili, was extradited from Moldova to the United States, where in May 2026 he was sentenced to fifteen years for soliciting hate crimes and distributing instructions for bombs and poisons; according to prosecutors, the Antioch attacker announced before his attack that he was acting on behalf of MKU and named Chkhikvishvili in his manifesto. In Sweden police arrested a man in his twenties who was building a Swedish branch of MKU through TikTok, Signal and Telegram. Russia’s FSB presents MKU as a project steered from Kyiv; Western researchers point out that the narrative suits the Kremlin. The conclusion for Poland is concrete: posts that read like calques from Russian need not mean a Russian operation. They may mean that Polish teenagers are reading machine-translated MKU texts. Both possibilities need checking, but they are different hypotheses, with different evidence.

Three features that mislead anyone looking for an organisation

For twenty years we learned terrorism according to one template: there is an ideology, around it an organisation, within the organisation a structure, and at the end an executor who believes in what he is doing. The services look for a manifesto, the prosecutor looks for a structure, the court asks about motive. The template is useful with jihadists and with the accelerationists of Atomwaffen. With 764 it is useful only as a list of things not to look for, because they are not there. Three features of this network invert the usual order, and each has to be named separately, because each changes the investigator’s work.

Feature one: there is no ideology, there is an aesthetic

In seized 764 material everything appears at once: swastikas and black suns from neo-Nazism, pentagrams and Baphomet from the British Order of Nine Angles, manuals of the Russian Cult, quotations from the manifestos of the Christchurch and Columbine attackers, accelerationist slogans about the collapse of the system, and alongside them “No Lives Matter” and texts about nothing mattering. Whoever looks for an ideology in this will find a contradiction on every page: neo-Nazi symbols among non-white perpetrators (Henderson was Black; the boy from Bolzano came from a Muslim family and sympathised at the same time with jihadism), Satanism without any practice, accelerationism without any project for what should come after the collapse. The Canadian government, in listing 764, wrote it down in plain words: the destruction of society not as a step towards a new order but as an end in itself. Argentino and Lindsay call these traditions an archive of transgression: one takes from them whatever shocks most, not what one believes. The boy from Trescore wrote that the skull mask expressed no ideology and simply looked good, and gave as his political views that only he himself mattered.

What follows from this. First, a symbol is not a motive: a carved swastika speaks of belonging to an aesthetic, not of convictions, and interviewing the perpetrator as a neo-Nazi will produce a transcript that explains nothing. Second, counter-radicalisation programmes built on counter-narratives have nothing here to argue with; what works is treating the child as a victim of coercive control, as the Bolzano case showed. Third, and this is good news for a prosecutor: the Polish definition of a terrorist offence in Article 115 § 20 of the Criminal Code does not require an ideology. Purpose is enough, and the purpose of seriously intimidating many people is the only constant these actors have. Nihilism does not protect against a terrorist classification; on the contrary, it fits one better than many an ideology.

Feature two: there is no organisation, there is communication

764 has no headquarters, no statute, no treasury and no leader without whom it would fall: Cadenhead has been behind bars since 2021 and Nepal since 2025, and the network goes on. What structure does in a classic organisation, the medium does here. An invitation link replaces recruitment. The role of channel administrator replaces a post. The price list of admission (so many acts of vandalism, so many extortions, one stabbing) replaces an oath. The archive of material about a victim, in their language a “lorebook,” replaces a file and doubles as the hook. The funnel of platforms: Roblox as bait, Discord as the hall, Telegram as the back office, Wire, Session and Signal as the safe. The language: English, because the audience is international; the Italian thirteen-year-old wrote his text in English, and Polish groups read calques from Russian. The rhythm: “terror weeks” announced in channels, streams announced hours before the act, an audience asking for a link. A change of name after every arrest. And a rule that would be unthinkable in a classic group: chat companions report one of their own to the police when it amuses them.

What follows from this. An investigation that looks for a “group” will find a dozen teenagers in four time zones and not a single meeting. An investigation that maps communication will find everything: who created the channel, who assigned roles, who set the conditions of entry, who received the material, who urged the attacker on during the stream. For Article 258 of the Criminal Code this has practical weight. An organised criminal group requires, according to case law, a degree of permanence and structure, however modest, and a division of roles; a 764 cell with an administrator, admission rules and an archive meets these conditions even though it has never gathered in one room, while a loose “milieu” does not. The line between the two runs through the server logs. One more thing: from the position of a child at a console, a 764 operator in Texas and a foreign service’s “curator” on Telegram look identical. Both write in English or in calques, both hand out tasks, both demand a recording. That is why Hypotheses A and C in this text are distinguished only by the contents of the phone, never by the description of the event itself.

Feature three: the direct perpetrator is the least important link

In a classic attack the perpetrator is the aim of the investigation. Here he is its starting point. Argentino and Lindsay call this role the directed follower: usually a minor, often a victim beforehand, pushed into the act by threat, by the promise of status, or by both, and chosen also because he is below the age of criminal responsibility. The fourteen-year-old from Borås stabbed because slashed tyres were not enough; the fourteen-year-old from Hässelby stabbed because “Chai” told him that as a minor he had nothing to fear; both were filmed and watched. The status from the act goes to the executor, but the content, the recording, goes to the operator and the archive. In this economy the executor is expendable: he will be arrested, perhaps betrayed by his own chat, and the network looks for the next one.

What follows from this. The phone of the fifteen-year-old near Wyszków is first of all a map to those who were meant to watch the helmet footage, and only then evidence against him. The question “why did he do it” matters less in these cases than the question “whom was he supposed to send it to.” Criminal law knows the answer: the instigator and the person who orders the act are liable as perpetrators, and the court in Umeå showed in September that this can be proven from chat logs, without a single meeting. If Polish investigations stop at the direct perpetrators, each of them will be complete and each will be empty.

Where the Polish details fit, and where they do not

There are three points of convergence, and each on its own is weak. Together they are strong, not as proof but as a reason to test this hypothesis first; by themselves they do not distinguish a network from imitation, which is what the phones are for.

First, the body. Cutting usernames or symbols into the skin as proof of loyalty and as material for publication is so common in 764 that the subculture has its own name for it. A swastika carved into a thirteen-year-old’s arm and a symbol on a fifteen-year-old’s body may be the self-expression of boys fascinated by fascism. They may also be proof sent to someone. One question decides it: is there a photograph of that cut on the phone, and who received it.

Second, the camera. In this subculture a helmet camera is not an accessory to the attack. The attack is an accessory to the footage. Slain764 filmed his attacks, Henderson and the Eskişehir attacker streamed, Finnigan wanted a stream of another person’s suicide because he needed material “for 764.” The Italian twelve-year-old from San Vito Lo Capo in May 2026 and the thirteen-year-old from Trescore Balneario in March had phones fixed to a helmet and to the neck in order to stream the attack. If the fifteen-year-old near Wyszków had someone to send the video to, that person is an accomplice, not a viewer.

Third, the route. Roblox as the place of first contact, Discord as the hall, Telegram as the back office: that is exactly the infrastructure described in American indictments. Even the Swedish gamer who set the Polish operation in motion fits the picture. Sweden is the European country with the best-documented presence of 764, so a Swedish teenager could recognise this language faster than a Polish police officer.

To these add weaker convergences: the cats killed by the thirteen-year-old from Książki (cruelty to animals is one of the rungs of initiation in 764), the explosive device in the nineteen-year-old’s backpack (as with the fifteen-year-old from Bolzano), the age of the attackers, the clustering of events in time, and the rumour of a “Bloody Friday.” The police found that there was no challenge, and as to that particular rumour they are probably right. But 764 announces “terror weeks,” like the one of March 2024 described in the British judgment. A rumour about a date is not evidence of a challenge. It is a reason to check whether someone in Polish-language channels announced a date.

Now what does not fit, because an honest hypothesis has to name its own weak points. There is so far no public information about a “curator,” or about any contact between any of the attackers and an outside person. The attacker on Mińska Street, a twenty-one-year-old woman assaulting strangers in the office of an adult education school, does not fit the profile and may be an entirely separate event, triggered by imitation or by illness. Most of the detentions of recent days concern threats and stupid videos, not acts. And there is a competing hypothesis that explains the clustering without any network at all: contagion.

Contagion is one of the stronger findings in this field. A 2015 study by Sherry Towers and colleagues showed, on American data, that a school shooting raises the probability of another for an average of thirteen days and that between a fifth and a third of such events can be attributed to contagion through media coverage. The attacks in Ostrołęka on 7 October and near Wyszków on 8 October, the threats and videos from Przasnysz and Pruszków, the attack on Mińska Street on 10 October whose motive the police have not established: that is the calendar of contagion, whether or not a network stood at its beginning. The Prime Minister used the word “imitation,” and it is the correct word. The trouble is that contagion and a network do not exclude each other. In this model the network supplies the first perpetrators and the template, the media supply the reach, and after that psychology does the rest on its own.

So there are three hypotheses to test in parallel. Hypothesis A: Polish cells, or contacts, within the ecosystem of 764, MKU and kindred groups, with people inciting or blackmailing in the background. Hypothesis B: self-radicalisation and contagion through coverage, with no “curators” and a borrowed aesthetic. Hypothesis C: the exploitation of A or B by a foreign service, which in Poland has a documented model of recruiting through Telegram for arson and sabotage, confirmed by the Polish authorities in the case of the fire at the Marywilska shopping centre in Warsaw, where, according to the Prime Minister, the operation was coordinated by a person in Russia. The hypotheses differ in their evidence. A leaves a trace in conversations and in material sent. B leaves a trace in browsing history and in the absence of conversations. C leaves a trace in money, in the choice of targets, and in the quality of the tradecraft. Until the phones have been read, every one of them is open.

Why it works: the psychology of the ladder, this time from the case files

The question every parent asks is how a fifteen-year-old from a Polish village gets to knives in a backpack and a camera on a helmet. The answer does not have to be guessed. For five years courts in Texas, London, Solna, Borås, Bolzano and Napier have been producing case files, and for two years researchers at West Point, King’s College and the universities of Helsinki and Montreal have been reading them. What follows is what those files show, arranged from entry to exit.

Who is sought out

On 8 October 2026, when Prasan Nepal pleaded guilty, the federal prosecutor’s office in Washington described a recruitment guide that circulated in the group: it directed members to seek victims among people with depression or mental illness, to enter online groups of girls who self-harm, to feign admiration, and then to obtain personal information that could be used for blackmail. Marc-André Argentino and Angus Lindsay, the authors of a June 2026 analysis in CTC Sentinel, the journal of West Point’s Combating Terrorism Center, add from the files of further cases that the victim is usually between eight and seventeen, that recruitment enters through eating-disorder, self-harm and gore communities, and that the perpetrators are only a few years older than their victims. In their dataset of 295 arrests across 33 countries, the median age of an offender at arrest is nineteen and the median age of a victim is thirteen. This invalidates the model of child protection in which the predator is an adult stranger. Here the predator is a peer, the first person who took the child seriously.

What the founder looks like

The file of Bradley Cadenhead, as quoted by Argentino and Lindsay, describes not a demon but a child the system saw and did not stop. At thirteen he was charged in juvenile court with making a terroristic threat after announcing that he would shoot up his junior high school; teachers documented his fixation on firearms and explosives. At fourteen he threatened to kill his father and was sent to a psychiatric hospital. He himself stated that he had been consuming gore from the age of ten “for the shock value” and cutting himself from the age of eleven. He met the co-founder of 764 on Minecraft. As administrator he directed victims to carve his initials and the number 764 into their bodies “as homage,” and described the group outright as a cult in which he was idolised. Asked about motive, he said it was about money and about power over people. The same pattern, a child fed on gore who becomes an architect of violence, repeats in his successors: Alexis Chavez, sentenced in July 2026 to forty years, entered the network as a child in 2022 and, according to the indictment, blackmailed some of his own victims into recruiting further girls. Kyle Spitze, one of the earliest members, admitted in his plea agreement that he acted with a terrorist motive, and received seventy-seven years.

What the files show about the executors

The most precisely documented case is the British one, because Mr Justice Jay read the psychiatrist’s conclusions aloud in court. Cameron Finnigan was adopted at six after a long period in care, bullied at school, out of formal education from year eight, and diagnosed at fifteen with complex developmental trauma, attachment difficulties, attention deficit disorder, depression and episodes of significant self-harm. The psychiatrist did not find autism; she found conduct disorder and an emerging dissocial personality. Her conclusion on motive deserves to be read twice: a desire to belong to a group he regarded as his only source of connection and friendship, intertwined with a fascination with violence and sadism as retaliation for slights he had suffered. Finnigan called himself a “high-level extorter,” boasted about the quality of his video edits and hyped others up to do “serious” things. The court accepted that the group had given him a sense of purpose and belonging, but rejected the defence that he had been drawn into it against his will: he held a prominent role in it. This matters for Polish investigators. The line “I was forced” is routine in these cases; sometimes it is true (Borås), sometimes false (Finnigan, and in New Zealand Ronndog Keefe), and it is decided by the chat logs, not by the statement.

The ladder has rungs, and each one is a form of control

From files and chat records, Argentino and Lindsay have read off the price list of admission. A cell demands a set number of acts from a candidate: several acts of vandalism, two or three acts of extortion, an act of cruelty to an animal, or a single stabbing or shooting. Each act must be recorded and sent in. This is at once an initiation, a hook (blackmail material against the new member) and the building of the cell’s brand. The Borås case exposes the mechanism in a single sentence: the fourteen-year-old slashed tyres, the group judged this insufficient and demanded a human being. He stabbed a woman he did not know, who was walking her dog, while viewers of the Discord livestream urged him in real time to finish. Afterwards his chat companions reported him to the police, as they themselves wrote, for a laugh.

Two things from this ladder bear directly on Poland. First: in the Stockholm case of Slain764, the court found that the person blackmailing him reassured him that, as a minor, he had nothing to fear. Francesco Marone has described the same pattern in Italy: the thirteen-year-old from Trescore Balneario wrote before his attack that since criminal liability in Italy begins at fourteen, he would use this to his advantage. Recruiters know the criminal codes better than parents do, and they choose executors below the threshold. In Poland the general age of criminal responsibility is seventeen; for murder a juvenile over fifteen may exceptionally be held liable as an adult, and since 2023 even a fourteen-year-old for its aggravated forms, but always by a court’s decision that depends on the circumstances and the offender’s maturity. This does not protect schools, but it changes the selection of executors. Second: when an act is recorded on instruction and sent to an audience that demands it, the audience is the instigator. In the Chai764 case (seventy-seven charges), Swedish prosecutors called this a pilot case for the question of whether serious violence can be committed at a distance. In September 2026 the Umeå district court answered that it can, sentencing the eighteen-year-old to ten and a half years in prison for, among other things, two attempted murders and aiding a third, committed through chat when he was between fifteen and seventeen; the judgment has been appealed. Polish law has known the answer for a long time, in Article 18 of the Criminal Code.

Why a child goes along with it

Now the science, in three layers, starting with the best established.

The first layer is the need for significance. Arie Kruglanski’s theory, built on two decades of radicalisation research, holds that the engine is the loss of a sense of one’s own worth (humiliation, rejection, invisibility) and the promise of regaining it; ideology is only the narrative of how to do it, and the group is the audience. Gerard Gill applied the theory to 764 and showed the paradox: a subculture devoid of meaning confers a sense of significance through transgression alone. Argentino and Lindsay speak of anomie in Durkheim’s sense: chronically lonely boys, cut off from institutions, in a world that rewards irony and escalation. The text written by the thirteen-year-old from Trescore, as summarised by the Italian agency ANSA, reads like a textbook illustration: he has no real friends, cannot stand going out, rages at the sight of peers enjoying themselves together, and calls breaking rules the greatest thrill of his life. Clinicians in Montreal (Rousseau and colleagues, 2025) now distinguish, among adolescents referred to their clinic, ideological violence from nihilistic violence, in which there is no aim beyond the act itself.

The second layer is the economy of status, which researchers call “clout chasing.” In an ordinary group status is built from what one has or can do; here it is built from what one has done and recorded. Argentino and Lindsay write plainly that in this subculture performance is not expressive but constitutive: it defines identity, sustains membership and drives escalation. The highest status comes from a killing; close behind it, driving a victim to suicide and filming an attack on strangers. Every piece of material is at once a trophy, a currency and a leash, because whoever has once sent a recording can be blackmailed. Psychology knows the phenomenon as escalation of commitment; here it is a working method. The aesthetic follows from the same economy: masks, helmets, texts in English, the body counts of earlier attacks written on the helmet of the twelve-year-old from San Vito Lo Capo, the “saints” of the footage. The West Point authors call ideology in these groups an archive of transgression, from which one takes whatever shocks most, not what one believes. That is why Polish boys can have a swastika on the arm and a Russian-language manual on the phone at the same time without being either Nazis or agents.

The third layer is coercive control, a concept from the study of domestic violence that researchers have carried over to peer relationships online. A fake relationship, gifts in game currency, then personal information, then a photograph, then a cut, then an act. Each rung is small relative to the one before, and each closes the way back. A 2026 Thorn report, cited by the CTC, calls this sadistic online exploitation and stresses that in these environments adolescents are at once the main victims and the main perpetrators. The dataset of 295 arrests records 5,375 victims, including 22 deaths and 1,747 victims of sadistic extortion, and the authors caution that some of those counted as offenders had earlier been victims of the same network.

To this add desensitisation: Cadenhead from the age of ten, Keefe through Christchurch edits on Call of Duty servers, the fifteen-year-old from Bolzano with a drive full of shooting footage. Research on exposure to media violence is cautious about the general population; about a person already susceptible, watching real death as entertainment, there is no dispute.

The imitation chain that has already happened in Europe

What is happening in Poland in October happened in Italy in the spring, and has been described. Between 25 March and 29 May 2026 Italy had four cases in sixty-five days: a thirteen-year-old in Trescore Balneario stabbed his French teacher in a corridor, livestreaming it on Telegram from a phone tied to his neck, after publishing a text full of nihilistic references; a seventeen-year-old in Perugia was planning a Columbine-style massacre; a fifteen-year-old in Arezzo voiced admiration for the Trescore attacker and an intention to repeat; a twelve-year-old in San Vito Lo Capo tried to stab his teacher wearing a helmet with a phone mounted on it to stream the attack, the helmet inscribed with the names and body counts of a dozen shootings and with the surname of the boy from Trescore. Marone calls this a domestic mimetic chain, with no proof of coordination but with proof of a shared audience: under the twelve-year-old’s post announcing the act four hours in advance, users asked for a link to the stream. The helmet camera near Wyszków thus has a prototype from May. And there is a detail that concerns us directly: the thirteen-year-old from Trescore kept up a chat with a thirteen-year-old girl writing from Poland, whom he pressed to self-harm on camera and threatened with revealing her secrets to her mother. The girl told her mother and left the group. Researchers describe the Trescore boy as adjacent to this milieu, not as a member of 764; which makes it all the more telling that Poland was on the milieu’s map in March, as a victim’s address.

The language of warning

Reid Meloy and his co-authors described in 2012 eight “warning behaviors” that precede targeted violence: from the pathway (planning, acquiring the means), through fixation and identification (identifying with earlier attackers, dressing as a warrior), to leakage, that is, betraying the intention to a third party. The thirteen-year-old from Książki leaked to a stranger in a game. The fifteen-year-old with the helmet camera displayed identification with attackers who streamed. The nineteen-year-old with the device in his backpack had been on the pathway for a long time. The Italian cases add the most contemporary pattern: leakage addressed not to a person but to an audience, in English, with a lead time measured in hours. None of these behaviours is rare among teenagers who will never attack. But their accumulation in one person is a signal that American school-safety systems treat as grounds for action, and Polish schools today have no tool even to name it.

There remains the fact that most complicates the criminal case: in these networks the perpetrator and the victim are often the same person at different moments. Argentino and Lindsay describe four roles between which people move fluidly: leaders and senior coercive operators, propagandists, extorters, and directed followers, usually minors. The boy from Borås was a directed follower; Chai764, who pushed him, an operator; Finnigan a propagandist and extorter at once. If any of the Polish attackers is a directed follower in this sense, the file should carry him both as a victim and as a suspect, and his interview requires a different protocol from the interview of an ideologue. If he is an operator, the protocol is the ordinary one, but the circle of suspects only begins with him.

Where it grows: the sociology of the room with a console

Sociologically, 764 is neither a sect nor an organisation. It is a subculture with its own market, with no leader who would be irreplaceable, and with a barrier to entry equal to an invitation link. Three features decide its portability.

First, it shares its infrastructure with the normal life of teenagers. Roblox has over a hundred million daily users; Discord is the standard messenger of gamers. The groups in which the Polish attackers radicalised numbered, according to o2.pl, as many as several thousand people, most of whom simply wanted to play. The recruiter does not have to search for anyone. He only has to notice who in the chat writes that he hates school and himself.

Second, it supplies community to those who have no other. The same mechanism that worked in skinhead gangs in the nineteen-nineties works today in channels whose names change weekly: someone finally takes you seriously, gives you a handle, gives you a task, praises you. For a teenager whose parents do not know what Discord is and whose teachers see only grades, this is sometimes the only relationship in which he is seen. That the one who sees him is a predator, he learns too late.

Third, its aesthetic is a collage that can be copied in an evening. Satanic symbols borrowed from the British Order of Nine Angles, runes and the black sun from neo-Nazism, masks and helmets from attackers’ footage, Russian MKU manuals, the number 764 in a username. The ideology need not be coherent, because it does not serve thinking; it serves recognising one’s own. This explains why Polish investigators see fascism, pro-Russian sentiment and nihilism all at once and cannot give it a single label. It is not a single label. It is a single shop.

Poland is not an exception here, only a late entrant. The Olsztyn case of spring 2025, three nineteen-year-olds charged with preparing attacks, including on a secondary school, and fascinated by Breivik, Tarrant and McVeigh, shows that the scene existed earlier; the courts at the time would not even extend their detention. The machetes in shopping malls described by a pupil from near Inowrocław are not 764, but they are the same hunger for status through violence that 764 knows how to harvest. If I understand correctly what happened in September and October, it is not the birth of a phenomenon but the moment it first broke through into the news.

What the 764 hypothesis changes in criminal law

The law as of 10 October 2026.

The classification of the direct perpetrators’ acts is essentially obvious: attempted murder, in Ostrołęka of many persons (Article 148 § 1 and § 3 of the Polish Criminal Code, Kodeks karny), murder near Wyszków, plus the provisions on explosives. The fifteen-year-old may answer for murder as an adult, because Article 10 § 2 of the Code allows this for a juvenile over fifteen in the case of that very offence, if the circumstances, the offender’s maturity and character so warrant and educational measures offer no prospect; a court will decide this after expert opinions, with the option of an extraordinary mitigation of sentence (Article 10 § 3). Since October 2023 Article 10 § 2a allows even a fourteen-year-old to be tried on these terms for the aggravated forms of murder. The 764 hypothesis mitigates nothing here. It changes three other things.

First, the circle of suspects. If someone incited, ordered or blackmailed, that person answers for incitement, for ordering the act or for directing it (Article 18 § 1 and § 2 of the Code) in respect of the same offence as the direct perpetrator, regardless of whether he sits in Poland, in Sweden or in Texas: an offence is deemed committed also where its effect occurred (Article 6 § 2 of the Code), and Polish criminal law applies to anyone who commits an offence on Polish territory (Article 5); instigation from abroad to a murder in a Polish school is therefore an offence committed in Poland, with no need to reach for Articles 110 and 113 and their conditions. A 764 cell with Polish members is an organised criminal group (Article 258), and if its purpose is to spread terror among many people, a group with a terrorist aim (Article 258 § 2 in conjunction with Article 115 § 20). Separately in play: grooming of minors online (Article 200a), the production and possession of child abuse material (Article 202), coercion by threat (Article 191), persistent harassment, including harassment that drives the victim to attempt suicide (Article 190a), inducing or assisting suicide (Article 151, with the doctrinal view that where the child is incapable of understanding the act, murder using the victim as an instrument comes into play), public incitement to crime (Article 255), dissemination of content that may facilitate a terrorist offence (Article 255a, which covers the MKU manuals and the No Lives Matter documents), and finally the propagation of Nazism (Article 256), which, with carved swastikas, is the least important charge and the easiest to prove.

Second, the terrorist classification. Article 115 § 20 of the Code defines a terrorist offence by its purpose, including the serious intimidation of many people. An attack on a school with a helmet camera, recorded so that it will circulate through the channels, has that purpose built into its construction. Canada reached this conclusion in December 2025 and listed the network. A Polish prosecutor does not need a list; he needs a finding of intent. The consequences are practical: the jurisdiction of the National Prosecutor’s Office and of the Internal Security Agency (ABW), different operational measures, a different sentencing range and a different basis for international cooperation.

Third, and most urgent: evidence. The material in this case is held by service providers, mostly American ones, and it is disappearing. Discord and Roblox are obliged to report child abuse material to the American NCMEC, from which it travels to the police forces of other countries; the Polish authorities should check whether reports concerning the same accounts have arrived in recent weeks. Preservation of data (Articles 16 and 29 of the Budapest Convention on Cybercrime) has to be requested in days, not months. Since 18 August 2026 Regulation (EU) 2023/1543 on European Production and Preservation Orders for electronic evidence has applied directly, allowing a Polish prosecutor to approach a provider offering services in the Union directly, with a deadline of ten days and, in an emergency, eight hours. Whether a Polish district prosecutor’s office is prepared for this I do not know; I know that in March 2026 the European Commission opened proceedings against twenty-two member states for failing to transpose the accompanying directive. Telegram, headquartered in Dubai, formally falls within this mechanism, because it offers services in the Union, but whether a company based outside the Union will actually execute the orders remains uncertain, though since 2024 it has cooperated with law enforcement more often than before. For Discord and Roblox, as American companies, a parallel route runs through the FBI, which has a legal attaché office in Warsaw and which runs 764 as a top-tier matter. There is no institution in the world today that knows more about this network. A Polish prosecutor has the right to ask it, and should do so this week.

The law passed by the Sejm on 8 October, which allows illegal content to be blocked, addresses a different problem. Blocking closes the window through which the public looks. The perpetrators come in through doors to which they hold the key: closed channels that no block reaches. This is not an argument against the law. It is an argument against treating it as the answer.

What to look for, and where

What follows is not a manual for perpetrators, who know all of it. It is a list of questions for those who have the perpetrators in custody.

In the seized phones

Not browsing history but relationships; the direct perpetrator’s phone is read first as a map to the operator and only then as evidence against him. Accounts on Discord and Telegram, the names of servers and channels, invitation links, the handles of interlocutors, including those with the number 764 or the names of the splinters. Photographs of cuts in the skin and their addressees. Helmet footage, if it exists, and streaming settings: who was meant to receive the stream. Gore collections and archives of earlier attacks. Documents: the No Lives Matter manifesto, Order of Nine Angles texts, Russian-language MKU manuals and their machine translations. Second-line messengers: Signal, Session, Wire, Element, Snapchat, and streaming platforms such as Kick. Traces of payments and cryptocurrency, because these are what distinguish Hypothesis C from the others. Foreign contacts and the time zones of activity, because 764 cells work in shifts across the Atlantic.

On bodies and in bedrooms

Cuts, scars, burns, symbols drawn on the skin in marker, and not only on the attackers but on their friends and siblings. In bedrooms: symbols, masks, helmets, handwritten notes with runes and pentagrams (the Spanish police found such notes at the home of the seventeen-year-old from Gipuzkoa), traces of rehearsal on a punchbag, injured or dead animals.

With the attackers themselves, differently from before

The interview should allow for the possibility that the person across the table is a victim. Questions about who wrote first, whether someone has his photographs, whether someone threatened his family, whether he had to send something in order to be admitted. If the answers are “yes,” we have a coerced person, and therefore both a different measure of guilt and a thread to the hands that hold the leash. The interview should be conducted by someone who knows the language of this subculture, not someone hearing it for the first time, because a child senses ignorance in the first minute and falls silent.

Among peers

The alarm in Poland was raised by a Swedish teenager because he was in the same room. Peers always know more than parents: they see handles, changes in behaviour, recordings, boasts. A school that wants to catch anything has to create a route by which such a Swede in a Polish classroom can report without becoming an informer. American school-safety systems rest on precisely this: on a reporting channel and on a team that does not punish but assesses. Parents will find useful the list of warning signs compiled by the British organisation Internet Matters: sudden secrecy in the use of Discord, new private servers, unexplained wounds, new vocabulary.

With the providers and abroad

Discord and Roblox have their own teams investigating 764 and data on reports from Poland. The FBI, Canada’s RCMP, Sweden’s Säpo, Spain’s Policía Nacional and the UK’s Counter Terrorism Policing are running cases in which Polish accounts may already appear. Europol and Eurojust have teams for child exploitation. Research centres (GNET at King’s College London, the Institute for Strategic Dialogue, the Accelerationism Research Consortium, the Combating Terrorism Center at West Point, NCITE in Omaha) publish descriptions of symbols, names and methods updated every few weeks; in Poland no one reads them systematically, and someone in every regional police headquarters should. Canada’s terrorist listing gives its police powers that a Polish prosecutor can draw on through mutual legal assistance; what such a listing changes in practice was set out by GNET in March 2026.

What not to do

Do not publish the attackers’ recordings, manifestos or handles: the contagion described above travels by publicity, and every post about “Bloody Friday” in recent days was free advertising. Do not treat the Russian thread as a conclusion, because it conveniently explains everything and excuses one from asking where the Polish boys who wanted to read this came from. Do not interview children as ideologues, because ideology is the thinnest layer in them. And do not reassure parents by denying the challenge until the phones have been read: the non-existence of one rumour is not a finding that no network exists.

A hypothesis, not a verdict

Let me repeat what in this text is certain, what is probable, and what is uncertain.

Certain: the 764 network exists, is present in Europe, has since 2024 been moving from sextortion to knife attacks and arson, and its infrastructure consists of the same platforms on which the Polish attackers radicalised; it is also certain that the milieu of nihilistic violence has already had contact with Polish children, because in March 2026 an Italian thirteen-year-old from that milieu was blackmailing a thirteen-year-old girl in Poland. Probable: the Polish events of late September and early October are at the very least contagion in the sense of Towers’s research, and among the attackers and detainees are people drawing on the ecosystem of 764, MKU and kindred groups. Uncertain: whether any of them had a “curator,” whether a Polish cell existed, and whether anyone from outside, including a foreign service, has plugged into the process.

Why state it publicly, if it is only a hypothesis? Because the steps that follow from it are cheap, fast and reversible: a preservation request to a provider, a question to the FBI, a different interview protocol, a reporting channel in schools. If the hypothesis is false, they cost a few weeks of work. If it is true and no one took them, they cost the next school. The case of the fifteen-year-old from Bolzano, arrested at an advanced stage of his plan and thanking the police a year later for stopping him, shows that stopping someone in time works.

The worst scenario is not that the hypothesis proves false. The worst is that it proves true and no one tested it, because the phones sat in an evidence locker and a preservation request to an American provider occurred to no one. The state cannot rely on an alert Swede sitting at the console next time. Its job is to be in that room itself.