Every Bitcoin Bear Market Ends With an Exchange Blowing Up

At 20:05 UTC on October 29, someone started draining Binance's hot wallets. Within about 20 minutes, roughly $6.3 billion was gone, including 18,270 bitcoin.

Binance froze withdrawals, bitcoin fell below $77,000, and the timing landed about 13 months after this cycle's peak. Mt. Gox, QuadrigaCX and FTX all failed at similar points in their cycles. This piece looks at why the worst custody failures keep showing up in bear markets, what the four-year cycle can and can't tell you, and the one part of it you control.

The attack on Binance is the largest crypto theft on record, about four times the size of the $1.5 billion Bybit hack in February 2025. Blockchain analytics firm TRM Labs attributed it "with high confidence" to TraderTraitor, a North Korean hacking unit tied to the Lazarus Group. TRM says the preparation started at least 36 hours earlier, with small withdrawals from Tornado Cash to fund the attacker's wallets.

Binance's early read, reported by CoinDesk, is that the attacker got in through a compromised DevOps engineer's laptop, used it to reach a service container, and pushed unauthorized withdrawals through Binance's own signing system. The exchange says it found "no evidence of any wallet private key leak." In other words, the keys were never stolen. The machine that uses them hacked.

Binance paused withdrawals, said "user funds are safe," and promised to cover every loss from its SAFU emergency fund (about $1 billion in bitcoin) plus company money. As of Friday morning it expected withdrawals to reopen within about 45 hours. Bitcoin dropped about 5% to below $77,000, and nearly $1.5 billion in leveraged positions were liquidated.

Bitcoin is now about 39% below its October 6, 2025 high of roughly $126,200. If you've been around for a few cycles, the shape of this week probably feels familiar.

The four-year clock

Bitcoin's supply schedule cuts the new-coin reward in half roughly every four years. Each cut has been followed by a run-up, a peak, and a long, painful slide. The record, as compiled by Bitcoin.com, looks like this:

This cycle tracked the old pattern on the way up. The peak came about 534 days after the April 2024 halving, close to where the last two peaks fell. In the last two cycles, the bottom arrived about 12 months after the top. Binance was hacked about 12.7 months after this one.

The way down has been different. Bitcoin hit roughly $58,000 to $60,000 in June 2026, only about eight months after the peak, then recovered into the $80,000s this fall. The drawdowns also keep getting shallower: 87%, then 84%, then 77%, and so far about 54%. Plenty of serious analysts, Bitwise's CIO among them, argue the four-year cycle is already dead, swamped by ETF money and a much bigger, more institutional market.

Nobody knows whether June was the bottom or whether there's another leg down. We don't either. But one part of the pattern has held every time, and it doesn't depend on the halving at all.

Same movie, different exchange

Mt. Gox, 2014. Mt. Gox handled most of the world's bitcoin trading in its day. It halted withdrawals on February 7, 2014, and filed for bankruptcy on February 28, saying about 850,000 bitcoin were missing. This one hit early in the bear market, not at the end. Bitcoin kept sliding for most of another year, to around $152 in January 2015.

QuadrigaCX, 2018 to 2019. Canada's largest exchange announced in January 2019 that its founder, Gerald Cotten, had died the previous month and that client funds were stuck. Bitcoin bottomed around $3,200 in December 2018, right as the story was unfolding. The Ontario Securities Commission's 2020 investigation found more than 76,000 clients lost about C$169 million, mostly to Cotten's own fraudulent trading with their money. The OSC called it "old-fashioned fraud wrapped in modern technology."

FTX, 2022. On November 7, 2022, Sam Bankman-Fried tweeted, "FTX is fine. Assets are fine." The next day FTX halted withdrawals, and it filed for bankruptcy on November 11. Bitcoin bottomed that same month near $15,500. A year later, FTX co-founder Gary Wang testified that FTX was not fine and the assets were not fine.

Binance, 2026. Withdrawals frozen during a slide, roughly a year after the peak, while the exchange says user funds are safe.

To be fair to Binance, this isn't FTX. Nothing so far suggests customer money was gambled away. The exchange held roughly $144 billion in assets before the hack, so the loss is about 4% of that, and it says it will make every customer whole. If it does, this is the best version of an exchange failure you'll ever see.

Even the best version meant millions of people couldn't move their bitcoin for two days while the price fell. They had to wait for a company to tell them when they could have their money back.

Why the blowups cluster in bear markets

Roger Garrison, the Auburn economist who spent his career drawing the Austrian business cycle as a set of simple diagrams (his book Time and Money is the fullest version), drew a sharp line between two kinds of growth. Growth funded by real savings is sustainable, because the resources to finish what's been started actually exist. Growth funded by new credit looks identical for a while. Prices rise, projects multiply, everyone feels richer. But the savings were never there, and when that becomes obvious, the boom turns into a bust. Jonathan Newman's tribute to Garrison at the Mises Institute walks through the framework if you want the full version.

Garrison was writing about whole economies, but bitcoin markets run a small version of the same thing every cycle. In a bull market, the "credit" is leverage and IOUs. Traders borrow against coins they don't hold. Exchanges post balances that are claims on bitcoin, not bitcoin itself. Lenders rehypothecate deposits. All of it trades as if it were the real thing, and in a rising market nobody checks.

A bear market is when everybody checks. Prices fall, leveraged positions get liquidated (another $1.5 billion of them this week), and customers start asking to withdraw. Any exchange with a hole in its balance sheet gets found out, because the withdrawals it can't honor arrive all at once. Quadriga and FTX weren't destroyed by the bear market. Their problems were already there, and the bear market exposed them.

Binance's failure is a different kind, but it rhymes. The weak point wasn't a missing balance. It was concentration. When one company holds $144 billion of other people's assets, it's worth North Korea's time to spend weeks studying one engineer's laptop. Nobody runs that kind of operation against a million separate hardware wallets. Pooled custody creates a single target that pays out billions to whoever breaks in.

What got frozen, and what didn't

Within hours of the theft, roughly $3 billion of the stolen funds were frozen. Tether froze around $1.6 to $1.8 billion in USDT, depending on whose count you use. Circle froze about $800 million in USDC. Ripple, the Arbitrum Security Council and World Liberty Financial froze smaller amounts.

Nobody froze the 18,270 bitcoin. TRM reports the coins are being split across a chain of new addresses to make them harder to trace.

This week, the companies that can freeze money used that power against a thief, and the victims are better off for it. But a dollar that a company can freeze for you is a dollar it can freeze on you. The same switch that stopped North Korea can stop a Canadian trucker, a journalist, or a customer whose account trips an automated flag.

Bitcoin doesn't have that switch, for anyone. The property that keeps the hacker's coins out of reach is the same property that keeps yours out of reach of anyone but you. The protection it offers isn't a company stepping in after the fact. It's never handing your keys to a company in the first place.

The variable you control

Whether the four-year cycle survives this round is a fair debate. It may already be broken. June may have been the bottom, or there may be more pain ahead. None of that is in your hands.

Custody is. Every exchange failure on the list above, and every one we left off, hurt people who were holding bitcoin on someone else's balance sheet when things went wrong. People who held their own keys didn't wait for a post-mortem or a SAFU payout. Their coins sat where they always were.

If this week has you thinking about it, a few practical steps:

• Move what you aren't actively trading to a wallet you control. Our guide on how to remove your bitcoin from an exchange walks through it, and why bitcoin custody matters covers the reasoning.
• Send a small test transaction first, and verify the receiving address on your wallet's own screen, not just on the screen you copied it from.
• Check that your backup is where you think it is, and that you could actually recover from it.
• Expect a wave of scams. Big hacks are always followed by fake "recovery" services and phishing emails pretending to be from the exchange. No legitimate company will ever ask for your recovery words. We wrote about how these attacks work in Your Hardware Wallet Keeps Your Keys Offline. Your Shipping Label Doesn't.
• Be careful with leverage in a falling market. The $1.5 billion liquidated this week belonged to real people.

Bear markets end. So far, every one has. If one more exchange is going to fail before this one ends, the time to get your bitcoin off of it is before it freezes withdrawals.

Bitcoin Well never holds your keys. Every purchase goes straight to a wallet you control, so there's nothing on our side to freeze.

A note on sourcing

Binance hack. Timeline, amounts by chain, attack method, laundering, freezes and attribution are from TRM Labs' October 30, 2026 report (onchain data as of 00:30 UTC). The laptop and service-container explanation, the "no evidence of any wallet private key leak" quote, the SAFU figure, the $144 billion asset figure and the price reaction are from CoinDesk (October 29 to 30, 2026). The withdrawal timeline and Richard Teng's comments are from Cointelegraph's live updates (October 30, 2026). Estimates of the total stolen range from about $5.9 billion (Chainalysis) to $6.4 billion; frozen totals range from $2.54 billion to $3 billion depending on the hour.

Cycle data. Halving dates, peaks, lows and drawdowns are from Bitcoin.com's "Bitcoin's 4-Year Cycle: What the Record Shows in 2026." Earlier cycle dates are month-level, so day counts are approximate. The June 2026 low is cited as roughly $58,000 (Bitcoin.com) to $60,000 (Mudrex).

Exchange failures. Mt. Gox from TechCrunch (February 28, 2014). QuadrigaCX from the Ontario Securities Commission's staff review (June 2020), via CBC. FTX from Sam Bankman-Fried's November 7, 2022 tweet and Gary Wang's trial testimony as reported by Blockworks (October 2023).

Garrison. Framework paraphrased from Time and Money: The Macroeconomics of Capital Structure (Routledge, 2001) and Jonathan Newman's "Roger Garrison and the Sustainable Growth of the Austrian School" (Mises Institute, March 18, 2026). No direct quotes are attributed to Garrison.