The latest geopolitical risk to crypto from the Strait of Hormuz has come via radio from a tanker under fire.
“Sepah Navy, Sepah Navy, this is Motor Vessel Sanmar Herald. You gave me clearance to go. My name is second name on your list. You gave me clearance to go. You are firing now. Let me turn back.”
That transmission, circulated by OSINTtechnical, was accompanied by a first-class maritime incident report from UKMTO, warning 037-26.
The warning said the master of a tanker reported being approached 20 nautical miles northeast of Oman by two IRGC gunboats, with no VHF challenge before the boats opened fire.
The tanker and crew were reported safe. Authorities were investigating.
Sanmar Herald’s plea over the radio captures the new reality in Hormuz, fake crypto clearance, real gunfire
A commercial tanker moved in one of the most heavily militarized shipping lanes on earth, the crew believed they had some form of clearance, and armed Iranian boats answered with direct fire.
The vessel widely identified was Sanmar Herald. The UKMTO warning does not name the tanker in the notice, though the radio exchange and subsequent social reporting linked the attack to that ship.
Taken together, the attack record and the bridge audio create a far sharper picture than the usual language around “regional tensions” or “shipping disruptions.”
This was a passage attempt at a live choke point under live authority, ending in live rounds, due to a crypto scam.
A recent report said Greek maritime risk firm MARISKS warned shipowners that unknown actors claiming to represent Iranian authorities had sent messages demanding transit fees in Bitcoin or Tether for safe passage through Hormuz.
MARISKS said at least one vessel hit by gunfire after trying to exit the strait on April 18 was believed to have been caught by the fraud.
Reuters said it could not verify which firms received the messages. That caveat still belongs at the center of the account. The attack is documented. The scam alert is documented. The direct payment trail to a named ship remains less settled in public reporting.
Even with that limit, the overlap between the two is too strong to brush aside. The message cited by MARISKS offered a procedure, a review by “Iranian Security Services,” a fee in BTC or USDT, and then transit “unimpeded at the pre-agreed time.”
That attack vector worked because Iran has recently requested payment in crypto for passage, and Hormuz has become a place where movement depended on permission, sequencing, and political control.
Shipping firms are looking at a corridor where authorization itself has become unstable, where route access can change by the day, and where crews are trying to distinguish real instructions from fakes while sitting in the crosshairs of a regional war.
A scam works when it sounds close enough to the truth
That is the key operational point. Fraud does not need to invent a world from scratch. It only needs to mimic the world already in front of the target.
In Hormuz, that world had already shifted in exactly the direction a scammer would need. Reuters reported earlier that transit during Iran’s brief reopening involved coordination with the IRGC and Iran’s Ports and Maritime Organization, with Tehran proposing tolls on vessels seeking safe passage.
Once that backdrop was in place, a fake message requesting payment in Bitcoin or Tether sounded like another coercive layer within an already coercive transit regime.
That helps explain why the radio traffic from Sanmar Herald carries so much weight.
“You gave me clearance to go” is the language of mariners operating inside a permission structure, or at least what they believed was one. The force of that sentence comes from its plainness. There is no ideology in it, no policy framing, no crypto jargon. There is only a captain trying to reconcile one authority signal with another, permission first, gunfire second, and asking to turn back before the contradiction becomes fatal.
The event also reaches beyond a single maritime scam. USDT appears here as the operating instrument within a choke point controlled by armed actors, sanctions pressure, and opaque rules of passage.
The tokens appeared as part of an attempt to enable physical movement through one of the world’s most important oil arteries.
USDT sits closest to the center of that mechanism. It carries dollar familiarity, deep liquidity, round-the-clock transferability, and global reach across jurisdictions where conventional payment rails may be blocked, delayed, or too exposed.
That makes it useful for legitimate trade, improvised settlement, and coercive demands alike. It also makes it visible to investigators and issuers.
Tether has repeatedly highlighted its ability to freeze wallets and assist law enforcement. Tether has frozen over $4 billion linked to crime. Stablecoins, therefore, occupy a peculiar position. They can function as both crisis and enforcement infrastructure.
A fraudulent transit fee priced in USDT promises dollar equivalence without the friction of the banking system. In a sanctions-heavy maritime corridor, that combination has obvious appeal to bad actors seeking to build credibility quickly.
Digital instructions now shape movement, exposure, and force in Hormuz
FatManTerra, who was at the heart of the FTX investigative reporting, pushed the most aggressive version of the claim on X, framing it as the first time a crypto transaction had led directly to maritime warfare.
The deeper importance of the Sanmar Herald incident lies in what it says about how Hormuz now functions. Shipping through the Strait has always carried geopolitical risk.
The current phase is unprecedented. Hundreds of ships and roughly 20,000 seafarers have been stranded in the Gulf.
Every stalled vessel creates pressure on schedules, cargo commitments, charter economics, and crew endurance.
Every rumor of an opening creates a rush to move. Every partial reopening creates a contest over who has real authority, who can give permission, and who is simply exploiting the confusion.
Inside that setting, a fake crypto-clearance message is a weaponized imitation of administrative control. It copies the language of process, then inserts a payment demand into a system where operators already expect tolls, inspections, queues, political sign-off, and sudden reversals.
That mechanism can influence real-world decisions long before investigators ever get near a wallet address. If a crew believes a message is real, or a ship manager believes a payment clears the next transit window, the effect is immediate. Steel moves. Engines turn. Course lines change. Exposure changes with them.
That collision also widens the set of institutions that now have skin in the crypto question. Stablecoin debates often sit with lawmakers, central banks, payment companies, issuers, and exchanges.
Hormuz pulls in shipowners, marine insurers, brokers, flag states, naval authorities, sanctions teams, and commodity traders. Once BTC and USDT appear in false transit orders inside a war-risk corridor, the discussion moves well beyond whether stablecoins are convenient or scalable. It moves into whether they are becoming part of the operating language of coercion at maritime choke points.
No wallet tracing or freeze action tied to the reported scam has been publicly documented in the material now circulating. Those gaps still exist.
Yet the incident already shows enough to suggest the attack report is real, the radio plea is widely circulated and has shaped understanding of the encounter, and the crypto scam warning is real.
What emerges from that combination is a maritime environment where authority can be forged, payment can be demanded in digital dollars, and a captain can find himself begging to turn back after being told he was cleared to proceed.
In Hormuz now, the danger can begin before gunboats appear on the horizon. A message that looks official enough, in a crypto payment request that fits the mood of the corridor, caused a civilian vessel to come under kinetic attack in a real warzone.