Greek maritime risk firm MARISKS issued an urgent warning on April 21, 2026, alerting shipowners worldwide that unknown actors have been sending fraudulent messages to shipping companies, falsely claiming to represent Iranian authorities and demanding cryptocurrency payments in exchange for guaranteed safe transit through the Strait of Hormuz. The firm stated: "These specific messages are a scam. [They were] not sent by Iranian authorities."

The fraudulent messages themselves leave little ambiguity about their intent. According to reporting by Insurance Journal and MarineLink, the text reads: "After providing the documents and assessing your eligibility by the Iranian Security Services, we will be able to determine the fee to be paid in cryptocurrency (BTC or USDT)."

The messages ask recipients to submit documents and then await a fee assessment from supposed "Iranian Security Services," with payment to be made in either Bitcoin (BTC) or Tether (USDT), a dollar-pegged stablecoin. The messages promise unimpeded passage at a pre-arranged time once funds are received. Bitcoin was trading at approximately $76,466 on April 21, up about 1.5% on the day. USDT held its $1.00 peg.

MARISKS said it believes at least one vessel that attempted to exit the strait on April 18 was likely a victim of the scheme. That ship, acting on the fraudulent assurance of cleared passage, was struck by gunfire from Iranian boats. MARISKS did not identify the vessel by name.

Also on April 18, the VLCC (Very Large Crude Carrier) Sanmar Herald and at least one other Indian vessel were attacked when Iran briefly re-opened the strait before reverting to near-total closure. No source consulted for this report has established that the Sanmar Herald or the other named Indian vessels were among those that received or acted on the fraudulent messages; the two sets of facts are correlated by date but are not equated in any cited source.

India's foreign ministry summoned Iran's ambassador in New Delhi in response. Reuters said it could not independently verify the scam messages or identify which companies were specifically targeted.

Why the Scam Worked as a Lure

The fraud is effective in part because Iran has genuinely explored crypto-denominated transit fees. Earlier this month, reporting confirmed that Iran was accepting Bitcoin at a rate of $1 per barrel of oil for tankers granted passage, an arrangement that, while disputed, has been widely reported in the shipping trade press. For a large crude carrier, that figure could total roughly $2 million. That publicly circulating context gave the fraudulent messages a surface-level plausibility that a demand routed through more conventional payment channels might lack, though that comparison reflects this publication's editorial analysis rather than a claim sourced to any cited authority.

Iran's use of crypto to sidestep sanctions is well documented. The country's central bank accumulated at least $507 million in USDT during 2025, according to reporting from January 2026, reportedly to support the Iranian rial and facilitate trade under sanctions.

Blockchain analytics firm Chainalysis tracked $7.78 billion in total crypto inflows into Iran's ecosystem in 2025, with wallets linked to the Islamic Revolutionary Guard Corps (IRGC) accounting for more than half of all inflows in the fourth quarter of that year.

TRM Labs found that TRON-based USDT (the TRC-20 standard) made up 67% of crypto volumes through Iran's largest exchange, Nobitex. Tether, the company that issues USDT, froze 42 Iran-linked wallet addresses in July 2025 in what BlockSec and TRM Labs described as Tether's largest such action to date, and separately froze $6.76 million in USDT connected to IRGC and Houthi-linked networks.

"USD-backed stablecoins have become an increasingly important payment mechanism" for Iran's sanctions-circumventing operations, Tom Keatinge, director of the Centre for Finance and Security at RUSI, told CoinDesk earlier this month. Andrew Fierman, head of national security intelligence at Chainalysis, noted that crypto "avoids traditional banking systems while providing access to USD-pegged assets critical for international trade amid comprehensive Iranian sanctions."

South Asia Faces the Sharpest Exposure

The scam lands against a backdrop of severe regional disruption. The Strait of Hormuz has been effectively closed since late February 2026, when the United States and Israel launched coordinated strikes on Iran under Operation Epic Fury, an operation that reportedly targeted Iranian military facilities and nuclear sites and that, according to some reports, resulted in the assassination of Supreme Leader Ali Khamenei. Before the conflict, roughly 138 vessels transited the strait daily, carrying about one-fifth of the world's oil and LNG. That figure has collapsed to near zero. Hundreds of ships and an estimated 20,000 seafarers remain stranded in the Gulf.

The crisis escalated further when, on April 12 and 13, the United States initiated a naval blockade of all Iranian ports. That escalation directly preceded the April 18 incident in which vessels attempting to transit the strait were struck by Iranian gunfire.

South Asian economies are bearing much of the strain. Pakistan sources 99% of its LNG from Qatar and the UAE. Bangladesh depends on the Gulf for 72% of its LNG, threatening energy supply to its garment manufacturing sector. India, the region's largest importer, sources more than half of its LNG from Gulf-linked routes and now has ships directly involved in the April 18 confrontation. Sri Lanka, still recovering from its recent fiscal crisis, depends on Gulf fertilizer and crude cargoes classified as critical by the Gulf Trade Exposure Index.

Africa is also facing significant exposure. Import disruptions of 5 to 10% have been recorded across critical trade categories on the continent. Gulf suppliers account for at least 20% of global seaborne fertilizer exports, and South Africa and Namibia have been identified as high-exposure nations by analysts tracking the closure's downstream effects.

What Shipping Companies Should Know

For compliance officers and shipowners, the scam carries a practical note worth flagging: any crypto payment made to fraudsters is permanently recorded on the blockchain. Firms like Chainalysis and TRM Labs can trace on-chain transactions, offering a higher chance of supporting forensic recovery attempts than if funds were wire-transferred to an opaque account. Wire transfers are not categorically untraceable and can be followed through SWIFT and correspondent banking channels, but on-chain forensics can in some cases provide more granular visibility into fund flows.

That said, recovery is not guaranteed. For shipowners, the practical implication is straightforward: any unsolicited offer of crypto-cleared passage through the strait should be treated as suspect and verified through direct, authenticated contact with official authorities before any action is taken or funds are moved.

The broader pattern presents a structural risk that will not resolve quickly. Iran's legitimate, if disputed, crypto toll discussions have created what analysts describe as a credibility halo for copycat schemes. The existence of publicly reported toll-taking activity makes fraudulent imitations harder to identify at first contact. The TRON network's USDT infrastructure compounds the problem: TRC-20 USDT is widely used by both Iranian entities and South Asian shipping operators, meaning the payment rails described in the fraudulent messages are already familiar to many of the intended targets. As long as Iran's toll proposals continue to circulate in the shipping trade press, copycat schemes will have ready material to work with.

Ceasefire negotiations have so far failed to reopen the strait, and the U.S. naval blockade remains in place. In the assessment of this publication, the pressure on regional shipping operators is unlikely to ease until a diplomatic resolution takes shape, and no such resolution is currently in view.