The Eco Wizard tanker was hit by two explosions just ten minutes apart on July 6, according to shipping publication Lloyd's List. The vessel was docked at Russia's Ust-Luga port on the Baltic Sea.
Russia's transport ministry stated on Telegram that there had been an "incident during loading and unloading operations" on the liquefied petroleum gas (LPG) tanker, leading to a "minor ammonia leak".
"The 23-person crew has been evacuated (...). There are no casualties," the ministry also specified.
Following the incident, regional governor Alexander Drozdenko wrote on Telegram that the leak posed no threat to health or the environment.
To display this content from Telegram, you must enable advertisement tracking and audience measurement.
While many questions remain unanswered, this incident raises concerns, particularly in light of recent similar incidents.
Seventh incident in seven months
Experts are pointing to similarities with explosions that have hit five tankers since the beginning of 2025.
Just two weeks before the incident involving the Eco Wizard, the crude oil tanker Vilamoura, also under Greek management, suffered an explosion. It was carrying one million barrels of crude oil off the coast of Libya and had to be towed to southern Greece.
To display this content from X (Twitter), you must enable advertisement tracking and audience measurement.
In the winter of 2025, four additional tankers had been targets of explosions, with three of those incidents occurring in the Mediterranean Sea.
The crude oil tanker Seacharm was damaged in mid-January while in the vicinity of Turkey's Ceyhan port; the Grace Ferrum was impacted off Libya in early February; and the Seajewel was hit in Italy's Savona port on February 15.
The port of Ust-Luga had previously experienced another incident on February 9, involving the tanker Koala.
These incidents came after the Ursa Major, a cargo ship owned by a company affiliated with the Russian Ministry of Defence, sank in the Mediterranean following several explosions in late December 2024.
Calls at Russian ports
Establishing a definitive link between these incidents remains challenging. But industry analysts consistently highlight a shared pattern: all the vessels involved had made regular port calls in Russia.
Public maritime traffic data reveals that in the two months before their respective explosions, three of the six tankers involved had stopped at the port of Ust-Luga, while the other three had visited Novorossiysk, a Russian port on the Black Sea.
“The perpetrators were likely targeting shipping for having called Russian ports,” wrote British maritime security firm Ambrey in a threat circular published on March 7, 2025, after the first five incidents.
“It’s difficult to speak about coincidence considering the nature of the attacks, the previous port calls, and the areas in which these explosions took place,” Tomas Alexa, a lead analyst at Ambrey, told the FRANCE 24 Observers team. He stressed that such incidents were "highly uncommon" in the region until recent months.
Martin Kelly, head of consulting services for British security agency EOS Risk, echoes this sentiment, arguing that not only the shared port calls but also the type of incidents and damage point to these not being isolated events.
Most vessels suffered multiple explosions close to their engine rooms and machinery.
Limpet mines?
The exact cause of the explosions remains unclear, but mounting evidence suggests that external factors, rather than any ship malfunction, are to blame.
For instance, TMS Tankers, which manages the Vilamoura, told TradeWinds that an "explosive device” was used in the tanker attack.
Experts believe these vessels may have been victims of naval mines.
“No naval mines have been recovered [...] but the damage and the timing of multiple concurrent explosions are highly suggestive of these weapons,” Ambrey wrote in March.
The maritime security firm said it had reviewed hull inspection footage that provided “clear evidence” of naval mines. “The footage revealed large breaches in the hull plating, with the metal deformed inward and clear shearing along the lap joints, indicative of high-intensity external explosions,” it wrote.
Attention is focused on a particular kind of naval mine: limpet mines.
Dryad Global, a maritime security firm, reported that a “clear pattern” was emerging, in which “vessels recently calling at Russian ports are being struck by suspected limpet mines”.
Dean Mikkelsen, an independent maritime analyst, told our team:
“Limpets are a type of mollusk. This sea creature attached itself to something. So essentially, a limpet mine is a disk that attaches itself to the hull of the ship and has to be manually put there by someone. Then, that limpet mine has either a time or remote detonation that causes it to explode.
They're generally fixed below the water line, most often near the engine room, where it can cause more damage.
They can cause precise damage to a specific vessel, by being detonated remotely and anticipating the position of the ship at a given time.”
How could these mines have been laid?
Ambrey states in its circular, “it [is] highly unlikely that naval mines would be placed whilst the vessel was alongside in port given the risks involved, but there are opportunities en route to/from ports where vessels have slowed down sufficiently for divers to attach limpets.”
Alexa from Ambrey explained:
"We believe that there is more than one team conducting these [explosions]. There might be teams operating in the Mediterranean, Aegean, Black Sea, and Baltic Sea. Therefore, there might be disparity and variety in the type of explosives they use. But we believe that the threat actor is acting as a unified force in different areas."
State actor
Who could be behind these explosions?
“It is highly likely that a state actor has deliberately targeted” the tankers, Ambrey assessed.
Alexa told our team:
"We believe it is a state actor because of the sophistication of the operation, the type of explosives likely used, and the overall geographical span of these events.
These limpet mines have to be attached by a diver, most likely in low visibility or at night. You have to be specially trained to be able to deliver explosive payloads and attach them to the vessels without being detected. None of the vessels prior to the explosions reported any suspicious behaviour."
“The attacks demonstrate military-grade sophistication,” Dryad Global wrote, estimating that they were “potentially involving state-sponsored actors or proxy groups amid the ongoing Russia-Ukraine conflict.”
Ukrainian Secret Services?
The vessels' connections to Russian ports have led some experts to suggest that Ukraine could be implicated in these explosions. Ukraine, however, has neither confirmed nor denied any link to the incidents.
In June, following the explosion of the Vilamoura, Ukraine's military intelligence merely indicated that the vessel was "belonging to Russia’s so-called shadow fleet” and had a “track record of transporting Russian oil products”.
To display this content from X (Twitter), you must enable advertisement tracking and audience measurement.
‘Deterring vessels from calling at Russian ports’
Kelly from EOS Risk Group told us:
“I think the actor that gains the most benefit from the series of attacks is Ukraine. There is no hard evidence or intelligence that I have seen that suggests it is Ukraine. But Russian exports are used to fund Russia's war against Ukraine. Disrupting these vessels would surely impact revenue from Russian exports.
By doing these attacks, I think Ukraine really sends a financial and reputational message to shipping firms that are still calling at Russian ports. The intent is quite clear: it is to deter vessels from calling and exporting Russian goods from Russian ports.”
He also pointed out that Ukraine has launched several attacks against Novorossiysk itself, aiming to put the port “out of action”.
However, some industry analysts remain cautious. “The reality of it is that we do not have evidence that it was done by Ukraine,” Alexa said. “Would Ukraine benefit from discouraging vessels from calling Russian ports? Yes.”
Unsanctioned Vessels
The implications may be even more significant considering that these six tankers were not subject to sanctions at the time of the explosions, Alexa noted.
Only the Koala has since been sanctioned by the EU for "transport[ing] crude oil (...) that originates in Russia or [is] exported from Russia". Its then manager, Lagosmarine Limited, had also been sanctioned by the US in January 2025.
While the Koala was on Lloyd's List's dark fleet watchlist, the other three tankers hit this winter – the Seacharm, Grace Ferrum, and Seajewel – were not part of this fleet, according to the publication.
As for the Vilamoura, despite accusations from Ukrainian intelligence services that it belonged to “Russia’s so-called shadow fleet”, Ukraine does not feature it on its registry of shadow fleet vessels.
Moreover, the majority of these vessels were not transporting products subject to sanctions, such as ammonium.
Several of these ships had docked at Novorossiysk port, which primarily exports Kazakh crude oil, according to Ambrey.
“We assessed that the threat actor does not differentiate whether you [are transporting] Kazakh oil or Russian oil. The differentiating factor appears to be Russian port calls.
Kazakhstan pays Russia a significant amount of money to export its oil through their ports. Whilst you might be exporting Kazakh oil, you are still using Russian ports and pay fees, entries, and port duties. So there is a considerable income [for Russia] even from the export of Kazakh oil.”
Implications of Libyan actors?
This, however, isn’t the only theory advanced by industry analysts. Lloyd's List also highlights a connection some vessels have with Libya. Two incidents – involving the Grace Ferrum and the Vilamoura – occurred off the country's coast.
“It remains a possibility, but the level of sophistication to deploy a limpet mine is probably consistent with a state actor rather than some sort of militia,” Kelly believes.
Nonetheless, those in the industry seem to have incorporated this threat into their thinking.
“We understand that Russia does conduct inspections in Ust-Luga, and that the Greek owners are now asking for inspections in Novorossiysk as well,” Alexa said.
As for the economic impact of these attacks, Alexa pointed out that the cost of maritime insurance for Russia “is holding steady" for now.
“That said, if we see further attacks of this nature, it is likely that it would lead to a rise in war risk premiums, which would therefore make doing business in Russia more expensive,” he added.
English (US) · 