What Is Happening

Shipping companies operating near the Strait of Hormuz are receiving messages that promise something no one can honestly sell them: guaranteed safe transit. The senders pose as Iranian officials or official intermediaries, and the price is a “transit fee” or “clearance payment” in Bitcoin or USDT.

This is not a rumor circulating on crypto Twitter. In April 2026, Reuters reported a security firm warning shipping companies about fraudulent safe-passage messages, and Forbes’s Steve Weisman examined how the scammers exploit the crisis by impersonating Iranian officials. As the crisis has continued into September, search interest in the scam wave has surged again — which is why this explainer exists.

The target profile is what makes this wave unusual. This is not retail investors being phished for seed phrases. The victims are shipping companies, shipmasters, and charterers — businesses under time pressure, with vessels and crews exposed, receiving what appears to be a state-adjacent demand. It is social engineering at the level of geopolitics.

Why the Scam Is Plausible: The Real Crypto Tolls

The cruel genius of the scheme is that it copies something real.

TRM Labs has documented Iran turning the strait into what it calls a crypto toll booth — transits priced up to $2 million, payable in yuan or cryptocurrency. CoinDesk reported Iran rolling out “Hormuz Safe”, a maritime insurance product for oil tankers trapped in the strait, paid in bitcoin.

So when a shipping operator receives a message demanding BTC for safe passage, the demand is not obviously absurd — a version of it is genuinely happening. That is what separates this from garden-variety phishing: the attackers don’t need to invent a payment rail, only to interpose themselves in a real one.

The pattern generalizes, and it is worth naming: wherever a crisis creates a new, unusual payment flow, a counterfeit of that flow follows. We saw it with relief donations, with COVID-era “contact tracing” payments, with exchange outage refunds. The Hormuz toll scam is the maritime edition.

How the Extortion Works

The mechanics, as reported, follow the standard extortion template with a nautical paint job:

  1. The costume. The sender poses as an Iranian official, government channel, or an intermediary claiming authority over transit clearance.
  2. The pressure. The vessel is trapped, scheduled, or insurance-exposed — the crisis supplies the deadline for free.
  3. The ask. A transit or clearance fee in BTC or USDT to a wallet address, with safe passage promised on payment.
  4. The disappear. The wallet takes the payment; the “clearance” never existed. There is no one to invoice and no chargeback rail in either sense of the word.

Note what the scam shares with every phishing attack we cover: it does not defeat your security, it borrows your procedures. The payment “looks like” a crisis cost of doing business — which is exactly why it clears an accounts-payable process that would reject a random crypto demand.

Why Crypto, and Why It Backfires

The attackers demand crypto for the usual reason — a belief that it is anonymous money. For state-level extortion the calculus has some truth: crypto payments cross borders without correspondent banks.

But BTC and USDT are not private by design. Both are public ledgers. Every payment to the scammer’s wallet is a permanent, timestamped record — and blockchain-analytics firms like TRM Labs build their business on exactly this: clustering addresses, following hops through mixers and exchanges, and mapping the network behind the wallets. USDT adds another chokepoint: the token’s issuer can freeze addresses, which is why sanctioned networks treat it as a sanctions risk as much as a payment rail.

The practical irony: a shipping company paying a fake toll in USDT creates evidence a bank wire never would. Tracing does not refund the payment — but it converts every victim’s transaction into a data point against the network.

The Verification Checklist

For anyone in logistics who receives a crypto transit demand, in the Gulf or anywhere else:

  • Channel first, message second. Real state-level arrangements — tolls, escorts, insurance — arrive through official channels: flag state, charter party, insurers, or the company’s designated security provider. A wallet address in an unsolicited email, VHF relay, or WhatsApp message is disqualifying on its face.
  • Ask who bills you. Legitimate crisis costs have an invoicing entity, a contract reference, and a paper trail your P&I club can review. “Pay this address” is not an invoice.
  • Loop your insurer. P&I clubs and war-risk insurers exist precisely for this moment; a genuine transit fee question is theirs to validate. Forbes’s coverage notes the scam specifically preys on operators who don’t check.
  • Treat the pressure as the tell. Every extortion scheme needs you to act before you verify. A real fee can wait for your compliance process; a fake one cannot.
  • If paid, preserve everything. The transaction hash, the message, the headers. On-chain evidence ages well — the first 24 hours of documentation decide whether the payment can be traced or frozen at an exchange.

The Bigger Lesson

Strip the geopolitics away and this is the same anatomy as the fake-recovery-agent scams that follow every theft, or the fake-support agents that follow every wallet drainer incident: attackers monetize the procedures you trust, wearing the uniform of whoever you’d obey in a crisis.

The maritime version just makes it vivid. When the stakes are a hull and crew, “pay first, verify later” is not a policy — it’s the attack surface. The defense is boring and absolute: official channels only, insurers in the loop, and no wallet address from a stranger is ever a fee.

Related reading: how stolen crypto is traced, the first 24 hours after a theft, and our explainers on mixers and sanctions.

Frequently Asked Questions

Is Iran actually charging ships cryptocurrency to pass through the Strait of Hormuz?

TRM Labs has documented Iran collecting tolls for Hormuz transits — up to $2 million per passage, payable in yuan or cryptocurrency — as leverage during the crisis, and CoinDesk reported an Iranian maritime insurance product for trapped tankers denominated in bitcoin. So crypto payments in the strait are a real phenomenon. The scam is a counterfeit version of it: criminals impersonating Iranian officials and pocketing the payments. The distinguishing feature is the channel — real state-level arrangements come through official channels, charter parties, and insurers, not unsolicited messages with a wallet address.

How do the Hormuz scam messages work?

They impersonate Iranian officials or government channels and contact shipping companies — often operators of vessels already trapped or planning a transit — demanding a 'transit fee' or 'clearance payment' in BTC or USDT in exchange for safe passage. Reuters reported a security firm warning shipping companies about exactly this pattern in April 2026. The social engineering mirrors every crypto extortion wave: a real crisis, an authority costume, a deadline, and a payment rail the victim hopes is untraceable. It is a phishing attack wearing a uniform.

Can the crypto payments be traced?

Yes — that is the practical irony of demanding BTC or USDT. Both ride on public blockchains, and blockchain-analytics firms like TRM Labs specialize in mapping exactly these flows: cluster the receiving addresses, follow the hops through mixers or exchanges, and attach real-world context. Tracing does not refund the victim, but it turns each payment into evidence — and it is why on-chain analysis has become a standard tool in sanctions and maritime-crime investigations.