Fraudsters Are Impersonating Iranian Authorities to Extort Crypto From Stranded Ships
Unknown actors are sending fake "clearance" messages to shipping companies trapped by the Hormuz crisis, demanding Bitcoin and Tether payments that will not deliver safe passage.
Greek maritime security firm MARISKS issued an alert on April 20, 2026, warning that criminals are posing as Iranian authorities to solicit cryptocurrency payments from shipping operators whose vessels are stranded west of the Strait of Hormuz. The firm confirmed the messages are fraudulent and believes at least one vessel that was fired upon while attempting to exit the strait on April 19 had paid scammers who promised unimpeded transit.
The fraudulent messages are precise in their mimicry of official process. One reads: "After providing the documents and assessing your eligibility by the Iranian Security Services, we will be able to determine the fee to be paid in cryptocurrency (BTC or USDT). Only then will your vessel be able to transit the strait unimpeded at the pre-agreed time." MARISKS confirmed the messages did not originate from Iranian authorities and urged shipping companies not to pay.
Why the Scam Works
The fraud succeeds partly because it mirrors a real system. Since mid-March 2026, Iran's Islamic Revolutionary Guard Corps (IRGC) has been operating a state-sanctioned toll program, charging shipping companies up to $2 million per vessel or roughly $1 per barrel of cargo, to transit the strait. Accepted payment methods include Chinese yuan (routed via Kunlun Bank and China's CIPS interbank system), Bitcoin, and possibly Tether (USDT). Iran has provided a formal legal justification for the toll through its "Strait of Hormuz Management Plan," approved on March 30 and 31, 2026, with Iranian officials arguing the country never ratified UNCLOS and is therefore entitled to charge for "services rendered." That bureaucratic scaffolding gives scammers a credible template to imitate.
TRM Labs, a blockchain intelligence firm, estimates the scheme could generate potential revenue of as much as $20 million per day from oil tankers alone, with monthly projections reaching $600 to $800 million if liquefied natural gas shipments are included. Analysts at TRM Labs have noted, however, that there is as yet no confirmed on-chain evidence that Bitcoin is being used for legitimate toll payments at any significant scale, meaning these figures represent a theoretical maximum based on vessel traffic mathematics rather than confirmed blockchain activity.
That legitimised state toll system provides the scam with its cover. When a government normalises large crypto payments as an official process, impersonators gain a ready-made set of procedures to mimic. Shipowners under extreme pressure to move their vessels have little time to verify the source of any communication offering clearance.
Approximately 2,500 ships carrying around 20,000 seafarers are currently stranded west of the strait, according to Foreign Policy. That is a large pool of desperate operators, many of whom may be willing to pay first and ask questions later.
The Crisis Behind the Vulnerability
The current standoff stems from an air campaign launched by the United States and Israel against Iran on February 28, 2026. Iran responded by closing the Strait of Hormuz, a waterway that normally carries about 20 percent of global seaborne oil trade, roughly 20 million barrels per day.
The US imposed a full naval blockade on Iran on April 13 after ceasefire talks in Islamabad collapsed. Iran closed the strait again on April 18, citing the blockade. Traffic stalled entirely on April 19 and 20 after Iranian gunboats fired on two Indian-flagged vessels, including the Sanmar Herald, a Very Large Crude Carrier (VLCC), despite the ships reportedly holding prior clearance.
Ari Redbord, global head of policy at TRM Labs, described the situation as "just an incredibly fast moving situation, really, in the midst of a war," noting that analysts have not yet confirmed on-chain evidence of Bitcoin being used for legitimate toll payments at any significant scale.
Andrew Fierman of blockchain analytics firm Chainalysis said it was "highly unsurprising that this type of trade would be happening via cryptocurrency as well." Iran has a well-documented record of sanctions evasion, and Fierman's observation reflects the broader infrastructure that makes crypto a natural instrument for such transactions.
Regional Exposure: South Asia and Africa
South Asian operators carry acute risk. Between 2,500 and 3,000 Indian sailors are among those stranded. India is the world's third-largest source of maritime crew and the top nation globally for abandoned seafarers. Eight India-flagged LPG tankers have successfully crossed the strait via diplomatic arrangements, a contrast that underscores how operators who have not yet secured legitimate clearance become the most vulnerable targets for fraud.
Pakistan was explicitly named by Iran on March 26, 2026, as one of five nations permitted to transit, making Pakistani-flagged operators a specific target for scammers who can plausibly claim to offer official clearance. Pakistan imports a significant share of its crude from Gulf states, which means its shipping operators face acute economic pressure to act quickly on any offer of passage, however unverified.
African importers face a compounding crisis of a different kind. About 77 percent of East Africa's oil imports originate from the Middle East, and South Africa imports roughly 80 percent of its fertilizer needs. The Hormuz closure has also contributed to rerouting Suez Canal traffic around Africa's Cape of Good Hope following resumed Houthi attacks, adding 10 to 15 days to transit times according to UNCTAD and compounding the costs the strait closure has already imposed on the continent. Smaller African shipping operators are also less likely to have access to maritime intelligence services capable of flagging fraudulent communications quickly. S&P Global's aggregate material price index has risen more than 25 percent since the conflict began.
Compliance and Legal Risk
Paying any crypto toll to Iran carries legal exposure beyond the fraud risk. The US Office of Foreign Assets Control (OFAC) treats crypto payments to sanctioned entities the same as dollar transfers. Routing funds through Bitcoin or Tether does not protect a company from sanctions liability. The US Treasury sanctioned two crypto exchanges, Zedcex and Zedxion, in January 2026 for facilitating Iranian military transactions, and the Department of Justice is probing Iran's use of Binance to circumvent sanctions restrictions.
The scale of Iran's crypto activity makes these risks concrete. Iran's total cryptocurrency ecosystem was valued at approximately $7.8 billion in 2025, and the IRGC accounted for roughly 50 percent of Iran's crypto activity in the fourth quarter of that year, according to reporting in Fortune and CoinDesk.
Compliance teams at exchanges serving Gulf-based or South Asian maritime clients should monitor for large inbound BTC or USDT transfers from corporate shipping accounts tied to claims of transit fees or clearance payments.
What Comes Next
The scam is unlikely to disappear while the underlying crisis persists. Thea Fourie of S&P Global Market Intelligence noted that "the longer the disruption in the Strait of Hormuz lasts, the bigger this gap in supply chain." MARISKS urged all shipping companies not to pay any unverified transit-clearance demands and to exercise the highest degree of caution before transferring funds in response to unsolicited communications.
Global crypto fraud losses reached an estimated $17 billion in 2025, and the average payment in a crypto scam grew 253 percent between 2024 and 2025, rising from $782 to $2,764 per incident. That growth reflects not simply a higher frequency of fraud but a sharp increase in the value extracted with each successful scam.
The Hormuz fraud represents a newer variant: state-level geopolitical pressure weaponised to make extortion look like legitimate bureaucracy.