Ports and maritime logistics operators are increasingly using blockchain to track cargo provenance and automate payments through smart contracts. However, most security tools such as Slither and Mythril still examine network activity, blockchain transactions, and smart contract code separately. This makes it difficult to detect attacks that move across layers. In this work, we propose MarCyGraph, an explainable Maritime Cyber Graph framework for detecting maritime cyber threats. It brings together evidence from five real public datasets: CICIoT2023, X-IIoTID, Elliptic, SmartBugs Curated, and MarineCadastre AIS. The data are organised as a graph with ten node types and fourteen edge types, covering Internet of Things devices, blockchain transactions, smart contracts, and maritime context. MarCyGraph uses a Heterogeneous Graph Transformer (HGT) to learn from these connected layers and provides explanations showing which layer and feature contributed to an alert. Instead of treating alerts as separate events, the framework links related evidence across the system. In the cross-layer task, it achieved 90.16% accuracy, 0.832 macro F1, 0.956 AUROC (Area Under the Receiver Operating Characteristic), and 0.844 AUPRC (Area Under the Precision-Recall Curve). It also improved macro F1 by 9.7 points compared with a homogeneous Graph Attention Network (GAT) model. These results suggest that MarCyGraph can help analysts connect an IoT anomaly with its possible blockchain impact, reducing the need to check several isolated tools manually during investigation.