A Comoros-flagged chemical and oil tanker, the Yara J, caught fire while anchored in Romanian territorial waters on Wednesday. The crew was evacuated. Romanian Defence Minister Radu Miruta said an investigation is underway into whether the ship was struck by a drone. The same day, multiple drones breached Romanian airspace near its border with Ukraine. The incident is not isolated. On Tuesday, two ships were hit in drone attacks off Bulgaria's Black Sea coast. One sank. Bulgarian Prime Minister Rumen Radev stopped short of attributing blame directly but said "the outcome benefits" Russia and summoned Moscow's ambassador. Earlier this month, a Turkish-owned grain ship carrying corn was struck by what Ukraine identified as two Russian drones in neutral waters, killing two crew members and sinking the vessel. President Zelenskyy called it "a horrific strike on a civilian vessel." On October 6, two more ships were hit in Bulgaria's exclusive economic zone. One sank, and search operations for the missing crew ended with no survivors found. The pattern is unmistakable: merchant shipping in the western Black Sea — well outside Ukraine's war zone — is now being struck with increasing frequency. The attackers remain formally unidentified in most cases, which is itself the point. Deniability is the operational design. The strategic logic is straightforward. Russia has motive to disrupt Black Sea grain corridors and energy routes, to test NATO's tolerance for incursions into member-state airspace and territorial waters, and to demonstrate that the alliance's southeastern flank is porous. Every drone that breaches Romanian or Bulgarian airspace without a decisive NATO response recalibrates Moscow's assessment of what it can get away with. Bulgaria's President Iliana Iotova has invited Romania and Turkey to consultations on merchant ship security — a trilateral initiative that is notable for what it reveals about the current vacuum. There is no standing NATO maritime security framework preventing these attacks, no joint patrol deterring them, and no attribution mechanism fast enough to name the attacker before the next ship burns. The consultations are improvised, not institutional. The cost structure is deeply asymmetric. Cheap drones destroy or damage million-dollar vessels. Insurance premiums for Black Sea shipping rise. Grain and energy cargoes become riskier. The economic burden falls on shipping companies, commodity importers, and ultimately consumers — none of whom have any lever to pull. Meanwhile, floating mines from the war continue to drift into commercial sea lanes, adding an indiscriminate baseline of hazard to every transit. Romania and Bulgaria are NATO members. Article 5 covers armed attack, but the hybrid-war playbook is designed to stay just below that threshold — each incident individually ambiguous, collectively devastating. The question is whether NATO treats these incidents as a pattern requiring a collective maritime response or as isolated accidents requiring investigation. The trajectory suggests the answer will be imposed by the next ship that sinks, not by strategic planning.