Daily intelligence briefing: 10 August 2026

The Hormuz negotiation enters the new week with its words and its water pointing in different directions. Foreign Minister Araghchi said on Sunday that the arrangement with Oman is in its final stages, while insisting that it does not itself reopen the strait, that no direct talks with Washington are under way, and that reopening waits on American concessions from sanctions relief to compensation for war damage. The waterway remains effectively shut, with transits running at a handful of vessels against a norm of around 130 and Brent above 84 dollars this morning. The conflict widened at the edges over the weekend: the Houthis put a drone into Saudi Aramco’s Jazan refinery on Sunday, days after Riyadh signed its defence pact with Turkey and Pakistan, and the fire was extinguished without casualties. London opens the week cooler at 27 degrees before the heat rebuilds to a forecast 33 by Thursday, with the yellow heat alert running to Tuesday evening and the week’s disruption loaded from Friday onwards. New York faces a difficult Monday of storms. On the digital side the Coldcard attacker’s Friday transfer remains the only significant movement of the stolen coin, and the extortion crew calling employees’ personal mobiles is confirmed to be operating under four new brand names, with some of America’s largest hedge funds among its recent targets.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The weekend passed quietly by London standards: Sunday’s Ashura procession on Park Lane was the capital’s principal crowd event and nothing concerning it appears in the Metropolitan Police newsroom, whose weekend releases cover an unexplained death in Croydon, a murder conviction from a Wembley nightclub shooting and a misconduct dismissal, none bearing on the standing picture. The Covent Garden position is unchanged, no fresh developments are reported from the Lambeth and Southwark operation, and the Palestine Action proscription remains fully in force. Today carries no major public events in central London, and the first half of the week looks operationally straightforward before the schedule thickens from Friday.

The heat eases briefly before returning. Today is sunny and around 27 degrees with high ultraviolet levels and moderate pollen, Tuesday is similar, and the temperature then climbs through 30 on Wednesday to a forecast 33 on Thursday, which would be the hottest day of the spell so far. The UK Health Security Agency’s yellow heat health alert for London currently runs until 21:00 on Tuesday, and with the week ahead hotter than the one just passed an extension should be anticipated, so the standing guidance on hydration, shade and vehicle cooling holds throughout, with particular care for older family members and staff posted outdoors. The hosepipe bans are unchanged, with Thames Water’s ban still covering London and the Thames Valley. On the railways the weekend’s engineering works have cleared, leaving the Barons Court westbound District and Piccadilly closure, which runs to November, as the standing constraint. The pressure arrives at the back of the week: the Arriva bus strikes across north London begin on Friday with further dates published into October, RMT members at East Midlands Railway strike again on Saturday, and The Weeknd opens five nights at Wembley Stadium on Friday, playing the 14th, 15th and 16th and returning on the 18th and 19th, so movements in north and north west London from Friday onwards should be planned with generous margins.

Travel corridors

The strait begins the week shut, and the language around it has settled into a pattern: the deal is always close, and the conditions never move. Foreign Minister Araghchi said on Sunday that the arrangement with Oman is in its final stages, but was explicit that it does not itself reopen the waterway, that messages are passing through intermediaries rather than direct talks, and that reopening waits on American concessions including the lifting of sanctions and compensation for war damage; he also accused Washington of breaching the June interim agreement. The American position remains that a deal could come soon, with the President saying he is personally involved, and the reported shape of the arrangement, Iranian oversight of northbound traffic with Oman managing southbound routes along its own coast, has already drawn criticism in Washington as a concession on freedom of navigation. The Arab League has formally held Iran responsible for Saturday’s missile strike on the ADNOC tanker. On the water the figures barely move: transits ran at between eight and fifteen vessels a day in early August against a norm of around 130, roughly 3 per cent of pre crisis volume, around 235 vessels are holding position, down from 455 as owners give up and divert, war risk premiums hold near thirty times normal levels with cover for a single large tanker costing some 10 million dollars and six protection and indemnity clubs withdrawn entirely, and American forces have redirected 51 commercial vessels, disabled two and boarded two in blockade enforcement. Brent opened the week firmer, with October futures at 84.43 dollars this morning, up more than 1 per cent and about 16 per cent above pre crisis levels, and the 60 day negotiating window attached to the interim understanding closes within the week.

The weekend’s sharpest development sits south of the strait. The Houthis struck Saudi Aramco’s Jazan refinery with a drone on Sunday morning, framing the attack as a response to Saudi overflights, and the timing, days after Riyadh signed its defence pact with Turkey and Pakistan, will not be lost on anyone; the Saudi energy ministry confirmed the fire was extinguished without injuries. The group also claimed strikes around the Yemeni port of Mokha, and its stated intention to extend attacks into the northern Red Sea stands. The Pentagon has meanwhile asked American arms manufacturers to accelerate production, a signal of how far the conflict has drawn down munitions stocks. Our travel advice does not move: all Gulf travel, including Dubai, should remain deferred until an agreement is not only signed but verified at sea, and any carrier restart should be treated as reversible at short notice. The carrier picture is largely unchanged from the weekend: Emirates has yet to restore Bahrain or Kuwait, Etihad is operating its daily Kuwait rotation and four weekly Bahrain services, Qatar Airways has restored Bahrain, Kuwait and Erbil, and flydubai and Air Arabia continue to operate with individual cancellations, so specific flights should be confirmed before any movement is built around them. The long suspensions hold: British Airways away from Dubai, Bahrain, Amman and Tel Aviv until 25 October, Lufthansa and SWISS away from Dubai until 13 September, which continues to bear on the Zurich corridor, Singapore Airlines and Cathay Pacific until 24 October, and Air Canada until the middle of January 2027.

In Europe the Barcelona ground handling strike enters its seventh day with no settlement in sight: the action is formally indefinite, minimum service requirements are holding operations together, and one recent day of action saw around 500 flights delayed and 19 cancelled across the affected Spanish airports, so routings through Barcelona should continue to be avoided where practical; Palma is operating normally. Paris carries its August engineering programme into a holiday week: the RER B central section is closed until 16 August, the RER C west of Austerlitz until 22 August, Nation on the RER A until 30 August, the RER D still runs no trains between Gare du Nord and Gare de Lyon, and Friday’s Assumption holiday will put the network on a reduced service, so airport transfers by road with generous margins remain preferable to rail. Geneva and Zurich are steady, with no significant developments and no strike action listed. In Monaco the position is as last reported: the Prosecutor General has confirmed cooperation with the Ukrainian authorities over the attempted assassination of Vadym Iermolaiev, though a joint investigation team has not yet been formalised; separately, wildfires in the Var have forced widespread forest closures west of the principality amid heat and strong winds, which bears on movements along the coast. New York’s reprieve was brief: Monday brings an 80 per cent chance of showers and thunderstorms with a flooding risk, and after Saturday’s 930 cancellations further ground stops at the three airports are a realistic prospect, so the main carriers’ rebooking waivers, which run into this week, should be used pre emptively and generous margins built into any transatlantic movement.

Digital and privacy exposure

The Coldcard picture is stable but not still. Friday’s transfer of just over 30 Bitcoin, worth some 1.9 million dollars, remains the principal attacker’s only movement, with roughly nine tenths of the stolen funds untouched and the largest single holder still sitting on 1,159 Bitcoin, while the smaller attacker continues to push coin through mixing services in patterns analysts describe as easily flagged. The attacker’s main wallet has meanwhile become a public noticeboard, filling with on chain messages that range from pleas for restitution to recovery offers and outright hustles, which reinforces a standing instruction: any unsolicited offer to recover stolen Bitcoin is hostile, whatever channel it arrives through. The rest of the guidance holds without change: assets on an affected Coldcard device should move to a fresh seed generated on updated firmware without delay, and Coinkite’s reversal of its deletion policy means ownership of these devices should now be treated as a matter of record rather than privacy.

The telephone extortion campaign has acquired names and figures. Google’s investigators have confirmed that the crew they track as UNC6671 is operating under at least four brands, Redact, Pink, Helix and Falcon, after retiring the BlackFile name in June, and reporting now names the targets of its recent wave against the financial sector: Point72, Millennium, Two Sigma and Citadel among the hedge funds, alongside several private equity firms. The method is unchanged and worth restating because it works: a call to an employee’s personal mobile impersonating the corporate helpdesk, often from a spoofed helpdesk number, a mandatory security migration or multi factor reset as the pretext, a lookalike login page harvesting credentials and session cookies in real time, then quiet collection inside Microsoft 365 or Okta with security notifications deleted as the attackers go. Traced payments exceed 10 million dollars for the first five months of the year, with typical settlements near three quarters of a million. The consequences of refusal are also now on display: the cancer diagnostics firm that declined to pay has had 10.9 million email addresses dumped alongside patient records, and Levi Strauss has confirmed that its own breach began with three telephone calls and no technical exploit at all. For family offices the defences remain procedural: callback verification through known channels for every credential, code and payment instruction, and, with August the peak month for burglary, no real time holiday posting from any family account.