May 5th, 2026: Iran Fires on U.S. Ships & Intelligence Shows Putin Scared Of A Coup

Summary

The President’s Daily Brief – May 5th, 2026
Host: Mike Baker, Former CIA Operations Officer
Podcast: The President's Daily Brief (The First TV)
Episode Theme: Escalating Conflict in the Strait of Hormuz, Putin’s Internal Security Fears, North Korea’s Role in Global Crypto Theft, and a Developing Search for Missing U.S. Soldiers in Morocco.

---

Episode Overview

This episode dives into major geopolitical developments: the first direct clash between U.S. and Iranian forces in the Strait of Hormuz under Operation Freedom, revelations about Vladimir Putin’s growing paranoia and internal security measures in Russia, North Korea’s dominance in the world of crypto theft, and the urgent multinational search for two missing U.S. soldiers after an exercise in Morocco. Mike Baker provides analysis, intelligence insights, and context for each story.

---

Key Discussion Points & Insights

1. Strait of Hormuz Escalation: U.S.-Iran Confrontation

• First Direct Engagement:

  • Just hours after the U.S. launched "Project Freedom" (a maritime operation to guide ships through the Strait of Hormuz), U.S. forces faced direct missile, drone, and naval attacks from Iran.
  • Iranian forces used cruise missiles, drones, and six fast-attack boats attempting to interfere with both U.S. destroyers and commercial vessels.
  • The U.S. military responded forcefully, destroying the Iranian boats; no American or commercial casualties reported.

• Strategic Implications:

  • The U.S. role has evolved from guiding ships to direct engagement—defining what "guiding" means in operational terms:
    • “It means clearing routes, moving alongside commercial vessels, and when challenged, being prepared to use force.” (Baker, 02:38)
  • Iran views U.S. operations as a ceasefire violation; while neither side has formally declared the truce over, “let’s be honest, it is essentially over.” (Baker, 03:37)

• Iran’s Calibration and U.S. Message:

  • Iran’s attacks seen as tests of U.S. engagement rules and willingness to escalate.
  • The U.S. response was intended to clearly signal “American forces didn’t hesitate. They engaged, they neutralized the threat, and kept the operation moving.” (Baker, 04:15)

• Broader Fallout:

  • UAE faced missile/drone attacks linked to Iran, causing fire and injuries at an oil facility near Fujairah.
  • Ongoing U.S.-Iran diplomacy described as “stalled,” with President Trump rejecting Iran’s latest 14-point plan outright as “not acceptable.”

---

2. Putin’s Growing Paranoia and Internal Coup Fears

• Heightened Security Measures:

  • Putin’s personal security has dramatically increased: over two dozen air defense systems now surround his residence; he’s spending more time in fortified bunkers.

• Insider Threats Over External:

  • Leaked intelligence points to growing concern about internal betrayal, not just drone strikes from Ukraine.
  • Increased surveillance, multiple layers of visitor screening, and limits on phone and device use among staff—reflecting “a leadership environment that is becoming more closed, more controlled, more paranoid and more focused on insider threats.” (Baker, 10:52)

• Ripple Effects:

  • High-profile assassinations (including a senior Russian officer) have led to infighting among security agencies.
  • Enhanced protection measures now extend beyond Putin to a wider circle of top military officials.
  • “Top officials reportedly held closed-door meetings where security agencies openly blamed one another for gaps in protection.” (Baker, 09:29)

---

3. North Korea’s Dominance in Crypto Theft

• Scale of the Problem:

  • “There’s one number that defines the crypto threat landscape in 2026, and that number is 76%. Now, that's the share of global crypto theft losses tied to North Korea.” (Baker, 12:03)

• Major Incidents:

  • Two mega-breaches account for most losses:
    • $285 million from Drift Protocol (April 1)
    • $292 million from Kelp Dao (April 18)
  • North Korean “Lazarus Group” and associated cyber units linked to these attacks.

• Modus Operandi:

  • Attacks are sophisticated, often involving months of prep, manipulation of blockchain mechanisms (like Solana’s “durable nonce”), and advanced laundering through crypto mixers (e.g., Tornado Cash).

• Denial and Bluster:

  • North Korea officially denies involvement, calling accusations “absurd slander” and claims the cyber threat is “non-existent,” while also warning of “necessary measures to defend the regime’s interests in cyberspace.” (Baker, 16:35)

---

4. Back of the Brief: Two U.S. Soldiers Missing in Morocco

• Incident Details:

  • Two U.S. Army soldiers went missing off Morocco’s coast during “African Lion 2026,” a massive NATO and partner exercise.
  • The incident occurred after a hike along hazardous cliffs led to one or more soldiers falling into the ocean. A rescue attempt may have resulted in additional personnel being swept away.

• Search Operation:

  • “A full scale multinational search and rescue effort is underway. Moroccan and U.S. Forces are now working alongside French and other allies with helicopters, ships and drones engaged in the effort.”
    (Baker, 19:40)

• Status:

  • Identities withheld. The exercise paused. Incident under investigation.

---

Notable Quotes & Memorable Moments

• On the Iran-U.S. Clash:

  • “It’s the least ceasefire-ish ceasefire of all time.” (Baker, 01:21)
  • “Tehran had made it clear … any efforts by the US to pry open the strait would be viewed as a violation of the ceasefire … let’s be honest, it is essentially over.” (Baker, 03:25)

• On Putin’s Fears:

  • “The threat Putin appears to be most concerned about may not be coming from outside Russia, but from within it.” (Baker, 08:08)
  • “This paints a picture of a leadership environment that is becoming more closed, more controlled, more paranoid...” (Baker, 10:52)

• On North Korea’s Crypto Thefts:

  • “They weren’t just breaking into the system, they were setting it up to fail on their timeline.” (Baker, 13:55)
  • “Move fast, disappear and wait … that is a known North Korean playbook.” (Baker, 14:31)
  • North Korean denial: “absurd slander ... cyber threat itself is ... non-existent.” (Baker, 16:35)

---

Important Timestamps

| Timestamp | Segment | |-----------|------------------------------------------------------| | 01:21 | Iran fires on U.S. ships, first direct confrontation | | 03:25 | The end of the ceasefire in all but name | | 04:15 | U.S. responses and escalation, broader regional hits | | 08:08 | Putin’s paranoia, internal threats | | 10:52 | Effects on Kremlin’s operations, system-wide paranoia| | 12:03 | North Korea’s 76% share in global crypto theft | | 13:55 | Details of Drift and Kelp Dao attacks | | 16:35 | North Korea denies cyber-involvement | | 19:40 | Soldiers missing in Morocco, multinational rescue |

---

Tone & Style

Mike Baker’s delivery is concise, matter-of-fact, and slightly sardonic at moments—emphasizing the urgency and gravity of unfolding global crises. He weaves tactical details with strategic insights, ensuring listeners understand both the “what” and the “why it matters.”

---

For Listeners Who Missed the Episode

This episode offers a comprehensive, up-to-the-minute intelligence briefing, focusing on:

• The mounting risk of full-scale U.S.–Iran conflict in a critical global oil chokepoint.
• The deepening internal insecurities surrounding Putin as Russia’s system closes ranks.
• North Korea’s cutting-edge cybercrime capabilities fueling its regime, despite global sanctions.
• A developing humanitarian and military crisis as allied forces search for missing American soldiers in North Africa.

Listeners walk away with not only the facts but the strategic context—arming themselves with knowledge central to understanding evolving challenges to American and global security.

Transcript

[A]

Hey, Mike Baker here. Now, did you know that Fast Growing Trees is America's largest and most trusted online nursery? Did you know that they've got thousands of trees and plants and over 2 million happy customers? Come on, seriously, 2 million satisfied customers. They have all the plants your yard or home needs, including fruit trees and privacy trees, flowering trees, shrubs, don't forget your shrubs and house plants. All grown with care and and guaranteed to arrive on your doorstep healthy. Whatever you're looking for, Fast Growing Trees helps you find options that actually work for your climate, for your space, for your lifestyle. Right now, they have great deals on spring planting essentials, up to half off on select plants. And listeners to the PDB get 20% off their first purchase when using the code PDB at checkout. That's an additional 20% off for better plants and better growing. At fast growingtrees.com using the code PDB at checkout, that's fast growing trees.com code PDB. Now is the perfect time to plant and use code PDB to save. Today. Offer is valid for a limited time. Terms and conditions may apply. It's Tuesday the 5th of May. Welcome to the President's daily brief on. I'm Mike Baker, your eyes and ears on the world stage. All right, let's get briefed. First up, it's the least ceasefire ish ceasefire of all time. Despite what is supposed to be a pause in the conflict, U.S. forces engaged Iranian boats and came under missile and drone fire just hours in the Project Freedom, the US operation, of course, to guide ships through the Strait of Hormuz. I'll have the details later in the show. New intelligence suggests Vladimir Putin isn't just worried about external threats, but the possibility of betrayal from within his own ranks. Plus, North Korea pushes back against accusations that it's behind the majority of global crypto theft, calling the claims politically motivated. And in today's back of the brief, two U.S. service members go missing during a military exercise in Morocco as search efforts are now underway. But first, today's PDB spotlight. Just hours after the US Began moving forward with its maritime operation dubbed Project Freedom, we've now seen the first direct confrontation between US And Iranian forces in the Strait of Hormuz. According to US Central Command, Iranian forces launched cruise missiles and drones at American destroyers and nearby commercial vessels transiting the strait. At the same time, six Iranian fast attack boats moved in attempting to interfere with those ships. Forces responded, engaging and destroying those boats before they could close the distance. And no hits were reported on U. S or commercial vessels. The U. S. Response answered one of the central questions that we raised earlier on the pdb. What exactly does it mean for the U. S. To, quote, guide ships through the Strait of Hormuz? Well, now we know it means American warships operating inside the contested waterway in close proximity to. To Iranian forces. It means clearing routes, moving alongside commercial vessels, and when challenged, being prepared to use force. It's an active military operation, one that now involves direct contact between US And Iranian forces. Tehran had made it clear in the days leading up to this that any efforts by the US to pry open the strait would be viewed as a violation of the ceasefire. And while both sides are still stopping short of formally declaring that the ceasefire is over, well, let's be honest, it is essentially over. What this appears to be is a calibrated move by Iran, testing US Rules of engagement, testing response times, testing just how far Washington is willing to go to impose itself in a space that Tehran believes it controls. And the US Response was just as clear. American forces didn't hesitate. They engaged, they neutralized the threat, and they kept the operation moving. Now, this was not the only action that Tehran took yesterday in response to the new US Operation, the United Arab Emirates reported incoming missile and drone attacks tied to Iran, targeting both infrastructure and a commercial tanker near the port of Fujairah. Most of the incoming fire was intercepted, but a drone strike did trigger a fire at an oil facility, and there were reports of injuries. Air defense systems were activated and alerts were sent out to civilians. And all of this is unfolding against the backdrop of stalled diplomacy. I'm being generous. And by calling it stalled diplomacy. The US And Iran have been exchanging proposals in recent weeks, but those talks were already struggling. President Trump has now rejected Iran's latest 14 point plan outright, calling it, quote, not acceptable. For now, Operation Freedom continues. US Forces are still operating in the Strait. Commercial vessels are still attempting to move through, and Washington is still framing this as a humanitarian effort to free stranded ships and crews. This was supposed to be a mission to escort ships safely through the contested waterway and to demonstrate to the Iranian regime that they do not control the strait. But given the regime's actions, it's now something else. It's a direct confrontation that threatens to unravel what's left of the supposed ceasefire. All right, coming up next, Vladimir Putin's security concerns may be shifting inward with new intelligence pointing to fears of betrayal as North Korea proclaims its innocence in the face of accusations that the Hermit Kingdom is behind the majority of global crypto theft. I'll be right back. Hey, Mike Baker here. Let me ask you a question. How many times during the week do you drop 10 or 20 or $30 on essentially meaningless items? In talking about impulse buys or just stuff that you honestly don't need? Now, those impulse purchases, well, they add up. And by the end of the week or the month, you're wondering where your money's gone. Well, let me tell you about what you could be doing with that money. Acre Gold. That's Acre. Acre Gold lets you turn that lost money into physical 24 karat Swiss gold. Look, you pick a plan, your balance builds, and once you hit the price of a bar, they ship it straight to your door. It's real gold in your hand, an asset that that's been valuable since the dawn of civilization. And for the collectors out there, Acre has just dropped the limited edition Hot Wheels collection. Remember Hot Wheels? Oh, yeah. These are officially licensed by Mattel. Strictly capped. And once they're gone, their history. While you're there, claim your free entry to the speed club sweepstakes. They're giving away 1 gram and 10 gram gold hot wheels bars in official collector's packaging. Start investing in a solid physical Asset for just $30@getacre gold.com PDB Once again, that's getacregold.com PDB

[B]

Starting a business can seem like a daunting task unless you have a partner like Shopify. They have the tools you need to start and grow your business. From designing a website to marketing to selling and beyond. Shopify can help with everything you need. There's a reason millions of companies like Mattel, Heinz and Allbirds continue to trust and use them. With Shopify on your side, turn your big business idea into Sign up for your $1 per month [e-mail] shop special offer.

[A]

Welcome back to the PDB. I wanted to follow up on a story we brought you yesterday about the growing paranoia of Russian President Putin and the extraordinary steps that he's taken to protect himself. And that includes over two dozen air defense systems now ringing his residence and increasing isolation. We're getting new reporting that helps explain what may be driving those decisions. And it points to something more serious than just external threats. According to leaked intelligence cited by multiple outlets, including CNN and the Kiev Post, Putin is increasingly concerned about the possibility of an assassination attempt, specifically one involving drones. That fear on its own wouldn't be entirely surprising. Ukraine has demonstrated an expanding ability to strike deep inside Russian territory. But that's only part of the picture. What's raising eyebrows is that the threat Putin appears to be most concerned about may not be coming from outside Russia, but from within it. The intelligence suggests growing concern inside the Kremlin about leaks of sensitive information and the possibility of a conspiracy involving members of Russia's own political or security elite. And that concern appears to be reshaping how the Kremlin operates. Security around Putin has reportedly been tightened even further. Visitors are now subject to multiple layers of screening, including full physical searches. The number of locations that he visits has been reduced, and there are indications that he's spending more time in fortified bunkers, sometimes working there for extended periods, while state media relies on pre recorded footage to project a sense of normalcy. But it's not just Putin. The same reporting suggests that concerns about security failures have begun to ripple through Russia's leadership. After a series of high profile incidents, including the killing of a senior military officer, top officials reportedly held closed door meetings where security agencies openly blamed one another for gaps in protection. At the center of those tensions are some of the most powerful figures in Russia's security apparatus, now reportedly clashing behind closed doors over just who is responsible for protecting senior leadership. As the the threat landscape continues to shift. In response, Putin has reportedly expanded enhanced protection measures beyond just his top general, extending them to a broader group of senior military officials. That's a notable shift, and one that suggests concern about the safety of the system as a whole, not just the man at the top. At the same time, control over the President's inner circle appears to be tightening. Staff working in close proximity to Putin are reportedly restricted from using mobile phones or Internet connected devices. Devices some are required to use offline equipment. There are also claims of increased surveillance, even extending into the homes of personnel such as security staff and support workers. In parts of Moscow, periodic Internet disruptions have also been linked, at least in part, to security measures aimed at countering potential drone threats. Taken together, this paints a picture of a leadership environment that is becoming more closed, more controlled, more paranoid and more focused on insider threats. Alright, shifting gears. There's one number that defines the crypto threat landscape in 2026, and that number is 76%. Now, that's the share of global crypto theft losses tied to North Korea. So how does a sanctioned regime, one cut off for much of the global financial system, end up dominating crypto theft on that scale? Well, that figure is largely driven by just two operations. A $285 million breach of Drift protocol on 1 April and a $292 million exploit targeting Kelp Dao on 18 April. Together, those two attacks make up just about 3% of total incidents this year, but 76% of the total money stolen. Now there's a lot of technical language wrapped up in all of this, so I'll break that down or will try to break that down because the mechanics here matter if you want to understand how this actually works. According to analysts at TRM Labs, it's a US based firm that tracks illicit crypto activity and works with government investigators. North Korea's cyber units aren't trying to overwhelm the system with constant attacks. Instead, many of these operations are tied to networks like the Lazarus Group. It's a state backed hacking outfit accused of stealing billions to bank role the regime's weapons programs. North Korea's share of global crypto theft has climbed steadily over the past several years, from under 10% in 2020 and 2021 to 64% in 2025. Now, through just the first few months of 2026, it's at 76%, the highest sustained share on record. Let's start with Drift Protocol. At its core, Drift is a decentralized trading platform built on Solana, which is essentially a fast moving blockchain network where users can buy and sell crypto assets cheaply and operate without a central authority. That's part of what makes it attractive and also what makes it vulnerable if the right safeguards aren't in place. According to TRM analysts, the campaign behind the Drift attack unfolded over weeks, if not months. It included targeted manipulation, technical setup and even reported in person interactions between North Korean operatives and individuals connected to the platform. By mid March, the attackers had already begun staging funds moving crypto through Tornado cash, a tool that mixes transactions together to obscure where the money came from. They exploited a Solana specific feature known as a quote durable nonce, which allows transactions to be pre approved and executed later in non technical terms. They weren't just breaking into the system, they were setting it up to fail on their timeline. So when the attack triggered on the 1st of April, it was all at once. 31 withdrawals in about 12 minutes. The funds were moved, converted, spread across digital wallets and left dormant. That is a known North Korean playbook. Move fast, disappear and wait, sometimes for months or years, then unwind the money slowly to avoid detection. Now let's compare that to Kelp Dao, which operates in the decentralized finance space where users move assets across different blockchains without relying on traditional banks. In this case, it used a system designed to verify and transfer assets between networks and that verification process is where everything broke down. Instead of targeting users, the attackers went after the infrastructure itself. They fed the system false data and launched a denial of service attack to knock out the legitimate data source, forcing the system to rely on the corrupted ones. With a single compromised data source serving as the authority, the system approved fraudulent transactions as legitimate. TRM analysts linked this operation to North Korean actors associated with the so called traitor, traitor network. Now, this may not surprise you, but Pyongyang, well, they deny all of it. North Korea's Foreign Ministry dismissed the accusations as a fabrication, calling them a, quote, absurd slander and even claiming the cyber threat itself is quote, non existent. But nothing to see here. There's no cyber threat. At the same time, officials in Pyongyang are warning they'll take what they call, quote, necessary measures to defend the regime's interests in cyberspace. That's a threat. With no further provided details. All right, up next in the back of the brief, two US Service members are missing after a training exercise in Morocco. More on that when we come back. Hey, Mike Baker here with an important message for every taxpayer out there. Now, you know this, we just finished tax season, right? But of course. Well, you also know this, there's always next year, right? The taxes never stop. Now, we've heard those radio ads about the irs. You know the ones I'm talking about? Plenty of ads. Plenty of companies out there telling you to be afraid, right? And they try to frighten you into calling. But I want to tell you about a different kind of company. It's Tax Relief advocates. Now, if you owe money to the IRS, whether it's 5,000 or 50,000 or 500,000, I hope it's not that. Tra, tax relief advocates as a solution to your tax problem, TRA could reduce or even eliminate what you owe to the irs. Their passion is taxes and helping individuals and businesses fix their IRS problems. They have over a thousand five star Google reviews and an A plus rating with a Better Business Bureau. And here's a the truth. You don't need to be afraid of the IRS any longer. Generous tax relief programs are now available that can give you a fresh start. So don't wait. Simply visit tra.com that's tra.com or call 800-583-6515. Once again, that number is 800-583-6515. Tax relief advocates, Real solutions for real people. Hey, Mike Baker here. Let me take just a moment of time to talk about something very important for anybody who's on Medicare or about to sign up for Medicare. Here's the thing. When folks get Medicare guidance, they rarely consider this fact. Agents get paid by big insurance to sell specific plans. It's just the way the business works. So that advice that you may be getting, it's not necessarily in your best interests. It means you're often shown what they're paid to show you. Not every option that's out there. And the result? Well, your doctor might not be covered or your prescriptions could cost way more than they should. And this problem is more common than you think. And those unnecessary costs, well, they can add up quickly. Here's what I think. You need someone with no skin in the game. And that's why I've partnered with Chapter. They're the only national advisor comparing every plan available. Their advisors are salaried, so they have zero incentive to steer you in a particular direction. And get this, It's a free 20 minute call. If you're turning 65 or you're already on Medicare, call Chapter at 915-671-5252. Again, that number, 915-671-5252.

[C]

Ryan Reynolds here from Mint Mobile. I don't know if you knew this, but anyone can get the same Premium Wireless for $15 a month plan that I've been enjoying. It's not just for celebrities. So do like I did and have one of your assistant's assistants switch you to Mint Mobile today. I'm told it's super easy to [e-mail]

[B]

Switch upfront payment of $45 for 3 month plan equivalent to $15 per month required intro rate first 3 months only, then full price plan options available, taxes and fees extra. See full [e-mail] hey, Bill O'Reilly here.

[C]

Please check out my new interview series. We'll do it live. Each Thursday I sit down with the most influential people in America. We're a no spin chat, no script. Anything could happen. You can find. We'll do it live on BillOriley.com YouTube or wherever you download your podcast.

[A]

In today's Back of the Brief, two US army soldiers are missing off the coast of Morocco after a routine training exercise turned into a dangerous rescue attempt, leaving a multinational search effort racing against time. According to US Africa Command, the soldiers were first reported missing on Saturday during training exercises known as African Lion 2026, which brings together American, NATO and 40 partner forces. By Sunday, the exercise was halted temporarily as U.S. moroccan and allied forces shifted to a coordinated search and rescue operation across land. Air and sea. A US Military official, speaking on the condition of anonymity, told the New York Times that the soldiers had gone out on what's described as an early evening hike near the Camp Draw training area. It's a long stretch of coastline known for steep cliffs and very rough surf. At some point, at least one of them is believed to have fallen into the ocean. Another US Military official who was at the scene said nearby personnel rushed to respond, forming a human chain down the cliff in an attempt to effect a rescue. According to officials, during the rescue effort, one or two additional personnel may have been swept into the sea. At this time, a full scale multinational search and rescue effort is underway. Moroccan and US Forces are now working alongside French and other allies with helicopters, ships and drones engaged in the effort. None of the missing have been identified and AFRICOM says the incident remains under investigation. And that, my friends, is the President's Daily brief for Tuesday 5th May. Now if you have any questions or comments, please reach out to me at pdbhefirsttv.com I'm Mike Baker and I'll be back later today with the PDB afternoon Bulletin. Until then, stay informed, stay safe, stay cool. Sam.