What Happened
On Monday, April 20, Greek maritime risk firm MARISKS issued a public alert warning shipowners that unknown actors posing as Iranian authorities had sent some shipping companies messages demanding transit fees in cryptocurrency for 'clearance' through the Strait of Hormuz. The messages instructed recipients to submit vessel documents for review by Iranian Security Services, after which a fee in Bitcoin or Tether would be determined and the vessel could transit at a pre-arranged time. MARISKS stated directly that these messages are fraudulent and did not originate from Iranian authorities.
The timing sits inside an unusually complicated geopolitical window. The US has maintained its blockade of Iranian ports for roughly a week. Iran has lifted and then re-imposed its blockade of Hormuz, a chokepoint that handled about a fifth of global oil and liquefied natural gas shipments before the Middle East conflict disrupted traffic. Amid ongoing ceasefire talks, Iran has proposed actual crypto-denominated tolls on vessels for safe transit. The Financial Times reported April 8 that Tehran is seeking up to $2 million per tanker, about $1 per barrel of oil, with payments accepted in Bitcoin. The scam exists because the real mechanism plausibly exists.
Why the Fraud Works
Every successful social engineering operation needs a plausible cover story. The Hormuz fraud template has one of the most plausible cover stories possible: a sovereign state operating a wartime chokepoint is demanding payment in a medium the state has publicly acknowledged it will accept. The target, a shipping company operator with a vessel stranded in an active war zone, has no way to independently verify which messages are from Iran and which are not. The Iranian government is not running a public verification portal for toll payments. There is no authoritative list of which crypto addresses belong to Tehran and which to opportunists.
The economic pressure on victims is also structural. A container ship costs approximately $30,000 to $60,000 per day in operational expenses while idle. A tanker can lose more. The 20,000 seafarers stranded in the Gulf are accumulating operational costs and cargo-spoilage risk every day the conflict continues. When a message arrives promising passage in exchange for a Bitcoin payment, the incentive to pay first and verify later is structurally high. The fraud operators are monetizing the exact pressure point Iran created by blockading the strait.
The Verified Victim
MARISKS believes at least one vessel that attempted to exit the strait on Saturday, April 18 was a victim of the fraud. On that day, Iran briefly opened the strait subject to checks, and at least two ships attempted to pass. Both reported Iranian boats firing on them, forcing them to turn around. One of the ships, MARISKS assesses, had paid the crypto 'fee' and scheduled the 'pre-arranged time' with what it believed were Iranian authorities. It transited to find the actual Iranian Navy had no record of any clearance. The company has no recourse against the operator that took the payment, because the operator was not the Iranian state. The company has no recourse against Iran, because Iran has no record of the transaction.
What This Means for You
For Bitcoin holders who are not shipping operators, the direct relevance is limited. The second-order relevance is significant. This is the clearest real-world demonstration of why crypto payment irreversibility creates attack surface in geopolitically stressed environments, and why finality becomes a liability in coercive, time-sensitive negotiations. A wire transfer routed through a fraudulent intermediary can often be reversed or clawed back through correspondent banking. A Bitcoin transfer to a fake Iranian authority signed during a war-induced chokepoint crisis cannot be reversed by anyone. The scam's success depends on the victim being unable to claw back the transfer once the ship is already committed to the route. The transaction is final. The recourse is zero.
The broader principle: any time a payment mechanism becomes the accepted rail for a high-stakes transaction in an environment without reliable verification infrastructure, fraud operators will monetize the verification gap. This applies to crypto-denominated ransom payments, crypto-denominated sanctions evasion, and crypto-denominated tolls in contested territory. The same properties that make Bitcoin attractive as a sovereignty tool, censorship resistance, finality, and pseudonymity, also make it attractive to fraudsters working alongside or within geopolitically chaotic environments. Understanding this is not an argument against self-custody. It is an argument for extreme verification discipline whenever the counterparty is unfamiliar and the stakes are high.
What to Watch
Watch the US-Iran ceasefire deadline on April 23 and whether a second round of peace talks proceeds in Pakistan. Watch whether any sovereign entity, Iran or another, establishes a verifiable public channel for legitimate toll payments, which would structurally eliminate the fraud vector. Watch for on-chain attribution of the fraud operator's wallets: blockchain analytics firms will almost certainly trace these flows, and the results may reveal whether this is opportunistic criminal activity, state-affiliated scamming, or something in between.