Daily intelligence briefing: 16 August 2026

The strait’s day 168 opens with the pattern confirmed: another Abu Dhabi National Oil Company vessel was attacked on Friday evening while transiting the waterway, the third strike on ADNOC shipping in under a week, and the UAE has coupled its accusation of Iran with a call to end hostilities and fully reopen the strait, its diplomatic adviser insisting the Emirates will safeguard freedom of navigation while continuing the path of dialogue. Tehran has said nothing about any of the three. United Kingdom Maritime Trade Operations separately reported a bulk carrier struck by an unknown projectile on Friday, and Brent closed the week at 88.52 dollars with markets shut for the weekend. London’s clean window held for Saturday but closes untidily: the amber heat health alert lapsed at 10:00 yesterday only for a yellow alert to take its place, running to 09:00 on Tuesday, though no Met Office warnings are in force and fresher air arrives today. Tonight is the third of The Weeknd’s five Wembley Stadium nights, on earlier Sunday timings, and the Formula E season finale concludes at ExCeL. The strike free interlude ends on Tuesday when the second Arriva block begins. On the digital side the Coldcard tally holds at 1,778 Bitcoin, and the UNC6671 reporting has a new wrinkle: one of the four brands is publicly denying it belongs to the operation at all.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Metropolitan Police newsroom carries nothing from the weekend that bears on the standing counter terrorism picture; the appeals that matter to this readership are unchanged, detectives still seeking information after a woman died following a burglary at her home in Finsbury Park, and the Clapham fatal shooting investigation continuing with the victim now identified. The Finsbury Park case remains the reference point for the month: a death in the course of a residential burglary, in peak season with families away, is the argument for treating the domestic perimeter as live rather than theoretical until the school term resumes.

The heat story did not close as cleanly as expected. The amber alert lapsed at 10:00 on Saturday, but the UK Health Security Agency immediately replaced it with a yellow alert for London, low impact but medium likelihood, running to 09:00 on Tuesday the 18th; no Met Office warnings are in force for the capital and fresher, less humid air arrives through today. The transport picture is the quietest of the month: the first Arriva walkout ended on Saturday morning, the East Midlands Railway strike series concluded with Saturday’s action, and no industrial action affects London today. The respite is short. The second Arriva block runs from Tuesday the 18th to Friday the 21st across 41 routes from eight north London garages, with a third from the 25th to the 28th, and TfL’s planned Piccadilly line closures coincide with some of those dates. Tonight is the third of The Weeknd’s five Wembley Stadium nights, on Sunday timings, doors at 16:30, on stage at 19:40 and out by 22:00, which brings the Metropolitan and Jubilee line crush forward into the early evening; the remaining nights are Tuesday and Wednesday. The Formula E London E-Prix concludes at ExCeL today, the second race of the double header closing the season, with racing inside and around the building through the afternoon.

Travel corridors

Hormuz enters day 168 with the ADNOC attacks now a pattern rather than an episode. Another ADNOC vessel was attacked on Friday evening while transiting the strait, the third in under a week after the 8 August strike and Thursday’s twin drone attack; no injuries were reported and the situation was described as under control. The UAE foreign ministry called on Iran to halt what it described as unprovoked attacks, end hostilities and fully reopen the waterway, and diplomatic adviser Anwar Gargash said the Emirates would safeguard its rights to freedom of navigation while continuing the path of dialogue, a formulation that names the adversary while keeping the exit open. Tehran has said nothing about any of the three attacks. UK Maritime Trade Operations separately reported a bulk carrier struck by an unknown projectile in the area on Friday. The commercial picture is unchanged and stark: tracker counts put daily crossings at around one against a pre crisis norm of roughly 73, some 506 vessels are holding position away from berth and 78 tankers went dark in the last 24 hours, war risk premiums for very large crude carriers remain at roughly 30 times pre crisis levels, around 10 million dollars a voyage, six protection and indemnity clubs have withdrawn cover and four of the nine largest container lines remain out of the strait. Brent closed the week at 88.52 dollars, up close to 23 per cent on pre crisis levels, and prediction markets price only a 2 per cent probability of a normalised strait by the end of August. Our test is unchanged and unmet: no verified normalisation of commercial transit has occurred, and all Gulf travel, including Dubai, should remain deferred.

The carrier calendar is quiet over the weekend and unchanged from Friday’s positions. Emirates operates its restored single daily Dubai to Bahrain rotation with Kuwait still suspended, and Turkish Airlines is flying Abu Dhabi, Dubai, Damascus, Beirut and Amman with Iran routes still off. Air France remains away from Riyadh until 21 August and from Dubai and Beirut until the 25th, KLM from Riyadh, Dammam and Dubai until 6 September, and British Airways from Dubai, Tel Aviv, Bahrain and Amman until 25 October, with Jeddah dropped permanently and Doha and Riyadh reduced to daily. Lufthansa and SWISS remain away from Dubai until 13 September, which continues to bear on the Zurich corridor, with the wider group’s regional suspensions running to 24 October; Singapore Airlines is away until 24 October, Cathay Pacific until the 25th and 26th, Finnair until 24 October, United until 7 September, Air Astana until the end of August and Air Canada holds to the middle of January 2027. Friday’s attack will not make the reversible restorations, Air France’s above all, any firmer. Specific flights should be confirmed before any movement is built around them.

Paris passes the final day of its deepest engineering trough. The RER B remains heavily disrupted between Gare du Nord and La Croix de Berny and Robinson through today, with the works due to conclude this evening and the northern branch running roughly one train every seven minutes in the meantime; the RER A stays closed between Vincennes and Noisy le Grand until the 23rd, the RER D is interrupted between Gare du Nord and Gare de Lyon, metro Line 13 is cut between Saint Denis Universite and La Fourche until tomorrow, and trams T1 and T2 remain interrupted, T2 until the 23rd. Road transfers with generous margins remain preferable today; rail improves materially from tomorrow as the RER B and Line 13 works conclude. Geneva is quiet, with the week’s cantonal figures, offences up 14.1 per cent since 2022 and vehicle thefts up 19.1 per cent, still the standing frame: the corridor’s exposure is property crime rather than violence. Zurich reports nothing new after Friday’s recovered wartime grenade, and the corridor’s real constraint remains the SWISS suspension from Dubai. Monaco is quiet in high season, but the forward diary now matters: the Vuelta a España takes its Grand Départ from the Principality on Saturday the 22nd, the first time the Spanish tour has started from Monaco, and the build up begins this week with local services already adjusting; road closures and heavy crowds should be planned around from about Thursday. New York’s clean window closes tonight: sunny and around 26 degrees today with a 30 per cent chance of showers after 14:00, thunderstorms likely through the evening with a 90 per cent chance of rain overnight, morning showers clearing Monday and a sunny Tuesday, with all three airports operating normally.

Digital and privacy exposure

The Coldcard picture is stable at its worst. Confirmed theft stands at 1,778 Bitcoin, roughly 112 million dollars drained from more than 5,000 affected addresses, with at least a dozen distinct attackers identified exploiting the same flaw: firmware version 4.0.1, shipped in March 2021, drew seed phrases from a predictable software generator rather than the device’s hardware entropy source. The bulk of attacker holdings sits unmoved under continuous public monitoring while mixing of the remainder continues, and the weekend brings no new sweep, which is itself worth noting: quiet phases in a theft of this scale are when recovery fraud does its work. The guidance is unchanged: assets on any affected Coldcard device should move to a fresh seed generated on updated firmware without delay, ownership of these devices should be treated as a matter of record, and every unsolicited approach concerning these funds, by any channel, should be treated as hostile.

The UNC6671 reporting has acquired a wrinkle worth understanding. Follow on coverage of Google’s account of the four brand operation notes that FALCON has publicly denied belonging to UNC6671 at all, claiming an exclusive affiliation with REDACT on its leak site; whether that is operational security, internal friction or simple marketing, it changes nothing for the defender, because all four brands run the same method on shared infrastructure. That method remains calls to personal mobile numbers from spoofed helpdesk lines, an urgent passkey enrolment pretext, lookalike single sign on pages harvesting credentials and tokens in real time, then scripted exfiltration from Microsoft 365 and Okta, with tracked payments above 10.6 million dollars and settlements clustering around three quarters of a million. Targeting has settled on financial services, legal and private equity, the firms that hold client identities and deal material, across North America, the United Kingdom and Australia. The defences are structural and unchanged: phishing resistant authentication genuinely enforced, since WebAuthn’s origin binding defeats the lookalike page outright; callback verification through known channels for every credential, code and payment instruction; and access restricted to managed devices. A quiet August Sunday is the right moment to close these gaps before the working week, and with families abroad in peak burglary month the standing rule against real time holiday posting from any family account applies with particular force.