Latest Intel
All 103 →ThreatsTrust Inversion5 min read
Hinkal Lost $820,000 After Its Privacy Proof Verification Failed to Verify Anything
An attacker drained roughly $820,000, nearly the protocol's entire total value locked, from Hinkal, a zero-knowledge privacy protocol, on July 3, 2026, by submitting a deposit that skipped the required cryptographic proof and then withdrawing funds the contract should have refused. Blockchain security firm CertiK confirmed the technique targeted Hinkal's core proof-verification step, and the stolen funds moved through Tornado Cash and a Thorchain bridge to Bitcoin within hours. It's the latest entry in OPNorange's Trust Inversion series: a mechanism built to provide privacy and security became the exact vector that broke both.
July 4, 2026
Intel6 min read
Supreme Court Strips SEC and CFTC Commissioners of 91-Year Removal Shield
The US Supreme Court ruled 6-3 on June 29, 2026 in Trump v. Slaughter that the president can remove commissioners at multi-member independent agencies without cause, overruling the 91-year-old Humphrey's Executor precedent and reaching the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC), the two agencies that set Bitcoin's regulatory posture. The same day, in Trump v. Cook, the Court carved the Federal Reserve out of that new removal power, leaving it as the only major financial regulator with structural independence intact.
July 1, 2026
GeopoliticsHormuz5 min read
IRGC Missiles Reach Bahrain and Kuwait
On June 28, Iran launched missile and drone strikes on Bahrain and Kuwait, expanding the conflict beyond the Strait of Hormuz into Gulf state capitals for the first time since the June 19 ceasefire signing. The day before, IRGC drones struck the Panama-flagged tanker M/T Kiku in the Strait, the second commercial vessel hit since the ceasefire. US Central Command confirmed additional retaliatory strikes on June 27 and stated that Iran had been given a chance to honor the ceasefire but elected not to. Iran countered by threatening a complete halt to nuclear and sanctions negotiations. The 30-day Hormuz reopening deadline runs to July 19. That deadline now sits inside a ceasefire framework that is attacking Gulf state capitals from one side and receiving fresh US strikes from the other. Iran's Bitcoin toll infrastructure was not decommissioned under the MOU. It was made inactive by a political commitment. That commitment is now under visible stress.
June 28, 2026
GeopoliticsHormuz5 min read
Drone Strike Tests the Hormuz Bitcoin-Toll Ceasefire
On June 26, an IRGC drone struck the M/V Ever Lovely, a Singapore-flagged cargo ship exiting the Strait of Hormuz, seven days after Tehran and Washington signed the Geneva ceasefire committing Iran to unrestricted commercial Strait access within 30 days. President Trump called it a 'foolish violation.' US Central Command struck Iranian missile, drone, and radar infrastructure in response. Iran's position: 'the Strait of Hormuz is governed by Iran' and the attack was 'ceasefire management, not a ceasefire violation.' The Bitcoin transit toll was supposed to end when unrestricted access took effect. That condition is now actively contested by the party that agreed to satisfy it.
June 27, 2026