Scammers Impersonate Iranian Authorities, Demand Bitcoin and Tether for Strait of Hormuz Transit

Fraudsters have targeted ships stranded near the Strait of Hormuz with messages impersonating Iranian authorities and demanding cryptocurrency payments in bitcoin or tether for “clearance” to pass, according to warnings cited by Reuters and issued by the Greek maritime risk management firm MARISKS.

“Crypto scammers are targeting the thousands of ships stranded near the Strait of Hormuz—and at least one ship that faced Iranian gunfire may have been tricked into believing it had paid Iran for safe passage”

Ars Technica

The first warning of the scheme came from MARISKS on April 20, Reuters reported, after scammers sent messages to shipping companies asking for “transit fee” payments in bitcoin or tether.

Ars Technica

MARISKS said the messages instructed companies to submit documents for assessment by “Iranian Security Services,” after which a cryptocurrency payment would be set and the vessel would be able to transit “unimpeded at the pre-agreed time.”

Reuters reported that MARISKS identified one ship as having potentially fallen victim after it attempted to pass through the strait on April 18, though Reuters said it was unable to confirm the information.

Marine Insight similarly described the fake messages as a scam and said MARISKS stressed they were not issued by Iranian authorities.

CoinDesk also reported that MARISKS issued a warning saying it believed at least one vessel fell victim and was fired upon while attempting to transit the strait over the weekend.

The scam is unfolding while the Strait of Hormuz remains disrupted by conflict and shifting access, leaving “about 2,000 ships and 20,000 mariners still stranded near the strait,” Reuters reported.

Multiple outlets described the scam’s mechanics as a staged process that blends document collection with a crypto payment demand.

MARISKS warned that unknown actors posing as Iranian authorities sent messages to shipowners asking for payments in Bitcoin or Tether for “clearance” through the strategic waterway, according to Marine Insight.

Benzinga

The fraudulent approach, MARISKS said, appeared designed to exploit confusion over access to the waterway where shipping movements remain heavily disrupted.

In a message cited by MARISKS and repeated by Decrypt, scammers told recipients: “After providing the documents and assessing your eligibility by the Iranian Security Services, we will be able to determine the fee to be paid in cryptocurrency (BTC or USDT). Only then will your vessel be able to transit the strait unimpeded at the pre-agreed time.”

Decrypt also reported that MARISKS believes at least one vessel fired at on Saturday while attempting to exit the strait during a brief reopening had paid the fraudulent fee.

Benzinga likewise said the fraudsters ask for vessel ownership documents, cargo manifests, and crew lists, and after reviewing paperwork they send a payment demand “often hundreds of thousands to millions of dollars in Bitcoin or USDT.”

Benzinga added that MARISKS said these messages are scams and were not sent by Iranian authorities.

The scam’s credibility is tied to an overlapping real-world policy discussion about crypto tolls for passage through the Strait of Hormuz.

“Fraudsters are targeting global shipping firms with fake payment demands in Strait of Hormuz transit schemes, seeking fees in Bitcoin and Tether as vessels remain stranded amid conflict in the Gulf”

Bitcoin Magazine

Ars Technica reported that Iranian authorities have demanded cryptocurrency payments from oil tankers to pass through the waterway and required ships to follow a route near Iran’s coastline to undergo inspection.

CoinDesk described the scam as following Tehran’s proposal to charge official crypto tolls for safe transit, and it reported that Marisks stressed the messages it flagged did not come from legitimate Iranian sources.

CoinDesk also pointed to a timeline in which shipping traffic has been largely blocked by Iran since Feb. 28, when the U.S. and Israel initiated a war on the Middle East country.

Ars Technica further reported that on April 22 the Liberia-flagged cargo ship Epaminondas, owned by the Greek company Technomar shipping and operated by the global shipping company MSC, was fired upon after it had reportedly received permission to pass through the strait.

Ars Technica said authorities were checking whether the message purporting to grant safe passage “may have been fraudulent,” citing Ekathimerini.

In parallel, Ars Technica said President Donald Trump extended the US-Iran war ceasefire even as the US continues to blockade Iranian ports.

Beyond the operational risk of being fired upon, outlets emphasized legal and compliance exposure tied to crypto payments demanded in a sanctions context.

Decrypt reported that “Experts warn any crypto transit payment carries sanctions liability, regardless of recipient,” and it quoted TRM Labs’ blockchain forensics perspective through Isabella Chase, head of policy for Europe, the Middle East, and Africa at TRM Labs.

CoinDesk

Decrypt quoted Chase warning that “crypto payments offer no safe harbour” from exposure and said any wallet addresses associated with these demands “should be treated as high-risk until independently verified through blockchain intelligence.”

Decrypt also stated that even an unwitting payment to a sanctioned entity carries legal liability under OFAC regulations.

Decrypt further quoted Chainalysis’ Xue Yin Peh, head of investigative strategy and collection at on-chain intelligence firm Chainalysis, saying: “Whether the recipient is genuinely Iranian or not, the intent to transact with a sanctioned regime is present.”

Decrypt also quoted Peh explaining that “Beyond sanctions, the company remains a victim of fraud, and the funds may still end up with actors who are sanctioned, designated, or involved in other illicit activity, even if they are not part of the Iranian regime.”

Marine Insight included a parallel caution, saying security experts have advised ship operators to be cautious of any unofficial payment demands and verify such messages through recognised authorities and trusted maritime security advisers.

The immediate consequence described across the reporting is that shipowners and operators face a dual threat: disrupted passage and the possibility that a payment demand could be fraudulent or could still create sanctions exposure.

“Crypto scammers offer ‘safe passage’ through Hormuz”

CoinDesk

Reuters-cited coverage in Ars Technica said MARISKS identified one ship potentially affected after it attempted to pass on April 18, and it said Reuters was unable to confirm that information, while Marine Insight said MARISKS believed one of the vessels may have been a victim of the scam operation.

Decrypt

CoinDesk reported that Marisks said at least one vessel fell victim and was fired upon while attempting to transit the strait, and it said Iran has not made any comment, Reuters added.

Benzinga reported that payment demands range from “hundreds of thousands to millions of dollars” in bitcoin or USDT, and it said hundreds of ships and about 20,000 seafarers remain stranded in the Gulf.

Ars Technica reported that there are about 2,000 ships and 20,000 mariners still stranded near the strait, and it said authorities were checking whether a message granting safe passage “may have been fraudulent” after the April 22 firing on Epaminondas.

Decrypt added that “standard anti-scam practices remain the strongest defense: verify demands through official channels, consult maritime security advisers, and treat urgent payment pressure as a red flag.”

Marine Insight said MARISKS issued its alert on April 21 warning that unknown actors were specifically targeting shipowners with vessels stranded west of the waterway.