Daily intelligence briefing: 4 August 2026

The picture in the Gulf turns on a contradiction this morning. President Trump says negotiations with Tehran resumed yesterday afternoon and describes a deal covering both the strait and denuclearisation as imminent, while Iran’s foreign ministry insists it is not negotiating with the United States at all and that the only live channel is the Omani track on a temporary safe route, and American officials have told CBS News that no new negotiations are planned. The water tells its own story: overnight a cargo vessel some 20 nautical miles north east of Khasab reported being struck by an unknown projectile, an incident the United Kingdom Maritime Trade Operations agency has classified as an attack and the third in those waters in four days. Brent has nonetheless held most of its relief fall, trading around 84 dollars and 60 cents this morning. In London the Piccadilly line has returned to a good service after yesterday’s failed resumption, and the city has another warm, sunny day of around 28 degrees. The digital picture is dominated by the Coldcard hardware wallet losses, which a fourth wave of thefts has taken towards 114 million dollars, and by new research showing that malware can hijack accounts protected by passkeys held in Google’s password manager.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Metropolitan Police newsroom remains quiet, with its most recent items still dating from the end of last week: the charge over assaults on prison staff at HMP Belmarsh and the arrest in Cyprus that opened the first overseas investigation under the National Security Act. The position on Palestine Action is unchanged from yesterday. The Supreme Court has granted the group’s founder permission to appeal against the proscription, with an expedited hearing expected in the autumn, but the ban remains fully in force, expressing support for the group is still an offence under the Terrorism Act, and any gathering linked to the group should continue to be given a wide berth following the dozens of arrests at last week’s rally. The heightened awareness we have advised around United States linked premises should be maintained at the same lower intensity while the diplomatic track, however contested, continues to run.

The weather is warm and settled once more, with London reaching around 28 degrees under sunny skies, high pollen, strong ultraviolet levels and no rain expected, easing to around 25 degrees tomorrow with a small chance of an early shower. The Piccadilly line has recovered: after Monday began with no service across its northern and eastern sections, the line is this morning reporting a good service along its full length. Yesterday’s performance was poor enough that journeys through the line should still be planned with a margin and checked shortly before departure until a full day of normal running is banked, and Heathrow movements retain the Elizabeth line and the Heathrow Express as dependable alternatives. Barons Court remains closed until November. The drought backdrop is unchanged, with drought declared across seven regions of England and eight hosepipe bans in force, including Thames Water’s covering London and the Thames Valley.

Travel corridors

The contradiction at the heart of the negotiation deserves careful reading. President Trump said negotiations would resume yesterday afternoon and described a new agreement, covering both the strait and the nuclear file, as imminent, having earlier called the Iranian leadership unbelievably duplicitous over Tehran’s denials. Iran’s foreign ministry spokesman Esmaeil Baghaei was explicit: Iran is not currently holding talks with the United States, the only live discussions are with Oman on a temporary safe route through the strait, an agreement with Muscat would not by itself reopen the waterway, and the strait will not return to its status before 28 February while what Tehran calls American aggression continues. American officials have separately told CBS News that no new negotiations are planned. The strikes remain called off, and the market continues to treat the weekend framework as alive, Brent trading around 84 dollars and 60 cents this morning, up around one per cent, with OPEC and its partners adding a further modest production increase from next month. The water remains dangerous: a cargo vessel reported being struck by an unknown projectile some 20 nautical miles north east of Khasab at 2200 UTC last night, an incident United Kingdom Maritime Trade Operations has classified as an attack, the third in those waters in four days, and no party has claimed responsibility.

Our travel advice is unchanged: all Gulf travel, including Dubai, should remain deferred until an agreement is signed and then verified at sea, principals still in the region should hold departure options on refundable routings, and any carrier restart should be treated as reversible at short notice. Dubai International remains open, with Emirates, flydubai, Etihad and Qatar Airways operating with adjustments, and the long suspensions hold: British Airways away from Dubai, Bahrain, Amman and Tel Aviv until 25 October, with Doha reduced to a single daily service and Riyadh reducing to one from 8 August, Lufthansa and SWISS away from Dubai until 13 September, which continues to bear on the Zurich corridor, KLM until 6 September, and Singapore Airlines and Cathay Pacific until 24 October. In Europe, Paris remains in normal posture with no strike action listed for the coming days, Geneva and Zurich are steady with generous airport buffers still advisable in the peak holiday period, and the Monaco parcel bombing investigation reports no fresh developments. The friction point for European connections is Spain, where the indefinite ground handling strike at Barcelona and Palma begins today and baggage and turnaround delays should be expected on any routing through either airport. New York offers a better window than yesterday: Monday’s storms have cleared, today is partly sunny at around 28 degrees with minimal thunderstorm risk, and while the air traffic control staffing shortfall remains structural and margins remain advisable, transatlantic movements face no specific weather constraint today.

Digital and privacy exposure

The Coldcard hardware wallet compromise has entered a fourth wave. Researchers now put cumulative losses at around 114 million dollars, some 1,816 Bitcoin drained from more than 5,200 addresses since 30 July, with the latest sweep beginning early Monday and moving at some 45 times the normal rate. Two details matter for affected holders. The flaw traces to a March 2021 firmware build that generated recovery seeds with a predictable software randomiser rather than the chip’s hardware one, and only single key wallets are affected, not multisignature arrangements. The fourth wave is also using Bitcoin’s replace by fee mechanism, which means a victim who sees a hostile transaction in the mempool can in some cases outbid it and rescue funds before confirmation. The instruction stands and has become more urgent: any principal or family office holding assets on an affected device should move them to a fresh seed generated on updated firmware without delay, taking specialist advice on the transfer, and should watch the mempool while doing so.

The EY exposure has firmed from claim to confirmed breach. The firm’s own disclosure describes unauthorised access to a third party IT support platform between 28 March and 12 April, with tax documents attached to support tickets among the material at risk, and American class action investigations are now under way. The scale has not been disclosed, which argues for the discipline we set out yesterday: families whose affairs the firm handles should assume convincing approaches referencing genuine tax matters, verify any unexpected contact through known numbers, and ask their advisers directly what was held. Two fresh items deserve attention. Researchers have shown that malware already resident on a computer can hijack accounts protected by passkeys stored in Google’s password manager without ever touching a fingerprint or face check, a reminder that passkeys raise the bar but do not remove the need for clean devices. In the United Kingdom, contact details for police officers and partner agencies held in the Police National Legal Database have appeared on the dark web, so any unexpected approach purporting to come from the police should be verified by calling 101 before anything is confirmed or handed over. The standing agenda is unchanged: treat every hotel and airport network as hostile and route all traffic through a trusted VPN, never enter a sign in code you did not generate yourself moments earlier, and hold absolutely to call back verification on any change to payment instructions.