A drone strike sank the Comoros-flagged cargo ship Khoryv about 13 nautical miles east of Constanța, Romania, on Friday, killing one sailor and leaving three missing as attacks on commercial shipping intensify along NATO’s Black Sea frontier.

Romania’s Interior Ministry said the vessel reported a fire at about 10 a.m. local time, suffered major damage and capsized outside the country’s territorial waters. Another commercial ship recovered 10 of the 13 people aboard: nine alive and one dead. Coast Guard and maritime-rescue vessels continued searching in rough weather for the other three, while poor visibility prevented a helicopter from joining the operation.

President Nicușor Dan said the ship had been hit by a drone and called the incident part of Russia’s escalation of its war against Ukraine. The Romanian accusation is significant, but investigators had not publicly released forensic evidence identifying the weapon or operator by Friday afternoon. The established facts are that the ship caught fire, capsized and sank; the attribution remains a government assessment rather than a completed investigation.

A civilian route has become a military pressure point

The Khoryv, carrying 10 Ukrainians and three Azerbaijanis, had left Turkey on October 21 and was heading for Sulina, according to shipping data cited by the Associated Press. Sulina sits at the mouth of the Danube and has become a critical gateway for Ukrainian grain and vegetable-oil exports as Russia repeatedly attacks Ukraine’s own Black Sea ports. Ships bound for the canal therefore travel through a narrow commercial corridor close to Romanian and Bulgarian waters.

Friday’s sinking was not an isolated accident. At least seven other cargo vessels have been attacked off Romania and Bulgaria this month, leaving two sailors dead and 25 missing, the AP reported. Reuters counted about 30 dead or missing across the recent incidents, reflecting differences in timing and which cases were included. The precise toll is still changing, but both accounts describe a sudden concentration of lethal attacks against civilian shipping near NATO members.

The location sharpens the legal and operational problem. Romania’s territorial sea extends 12 nautical miles from shore; the Khoryv was reported roughly one mile beyond it. That placed the ship outside sovereign Romanian waters but close enough that Romanian rescue agencies responded and any hostile drone would have operated near a heavily monitored NATO coastline. The narrow distance complicates interception decisions because authorities must distinguish weapons, wreckage and legitimate aircraft or vessels before acting.

Romania has already moved from monitoring to interception

Six days before the sinking, Romanian F-16s shot down two Geran-family attack drones after they entered national airspace over the Black Sea. The Defense Ministry’s official update said the aircraft entered Romanian airspace for two and five minutes before being destroyed east and southeast of Sulina. The ministry also said several commercial vessels had been struck during the preceding week, including inside Romanian territorial waters.

Those interceptions marked a shift from documenting incursions to using force against them. Romanian authorities had already scrambled aircraft repeatedly as Russian attacks on Ukrainian ports pushed drones and debris toward the border. The two targets destroyed on October 17 were jet-powered Geran variants, according to the ministry, creating a faster detection and engagement problem than earlier propeller-driven systems.

Romania’s Supreme Council of National Defence responded Thursday by ordering faster development of maritime surveillance, mine-countermeasure equipment and systems capable of responding to drones that illegally enter national airspace or waters. The council also called for closer coordination with Bulgaria and Turkey and stronger deterrence on NATO’s eastern flank, according to a Reuters account of the meeting. Friday’s sinking occurred less than a day later, underscoring the gap between approving new capabilities and placing them in position.

NATO reinforcements face a difficult protection mission

NATO said this week that allies had sent or would send additional maritime patrol aircraft, radar systems, drones, intelligence personnel and explosive-analysis teams to the Black Sea. The deployment plan can improve warning, attribution and the reconstruction of attacks, but the alliance has not disclosed the number, basing or operating rules for the new assets.

Protecting merchant traffic is harder than defending a fixed site. Commercial vessels move through broad international waters, fly many flags and maintain predictable routes. Small drones can approach at low altitude or near the surface, while debris from an interception can still endanger crews. NATO must also avoid turning routine shipping lanes into an uncontrolled military engagement zone or implying that every ship outside territorial waters has an automatic alliance escort.

The Montreux Convention further limits how outside naval forces enter the Black Sea during wartime, increasing the importance of the three littoral NATO members — Romania, Bulgaria and Turkey — and of aircraft and sensors that can deploy without sending additional warships through the Turkish straits. The immediate objective is therefore layered awareness and faster response, not a conventional naval blockade.

The investigation will determine the next escalation risk

Evidence recovered from wreckage, radar tracks and survivors could clarify whether the Khoryv was deliberately targeted, struck by a weapon pursuing another objective or hit by a drone that had lost control. Those distinctions matter for attribution and any NATO response. Dan’s accusation places political responsibility on Russia, but the alliance will need technical evidence if it is to connect the sinking formally to a state-directed campaign.

For now, the consequences are already tangible. One sailor is dead, three remain missing, and a route that carries Ukrainian exports through the Danube is becoming more dangerous and expensive to insure and operate. The sinking does not by itself trigger NATO’s collective-defense clause because it occurred outside Romanian territorial waters and involved a foreign-flagged civilian vessel. It does, however, intensify pressure on the alliance to show that the surveillance and counter-drone measures announced this week can protect navigation before another attack moves even closer to allied territory.