Bitcoin’s next major drawdown narrative is coming into question as on-chain and holder-behavior analysis suggest the market may have already absorbed much of its selling pressure. James Check, founder and lead analyst at Checkonchain, argued that Bitcoin likely formed its cycle bottom after two capitulation-style events rather than waiting for a late-2026 timing window tied to the so-called four-year cycle.

At the time of writing, Bitcoin was trading around $77,400, following a peak of just over $126,000 in October 2025—about 39% below that high. Check’s view challenges expectations that another low is due in October 2026, including earlier calls from analysts who referenced cycle-duration patterns and the US midterm-election calendar.

Key takeaways

• Checkonchain founder James Check said Bitcoin showed “price-pain” and “time-pain” capitulation behavior around the February and June–July drawdowns.
• He argued the market’s cost-basis concentration and holder profitability dynamics indicate selling pressure may have been largely processed earlier than anticipated.
• Check cautioned traders against anchoring decisions to calendar-based four-year cycle timing without accompanying evidence of exhaustion.
• Grayscale research head Zach Pandl similarly suggested a potential bottom near $58,000 at the end of June, citing a relatively contained decline and reduced “bad-news” downside.
• On-chain signals are still mixed: some metrics point to muted dip-buying, while others show short-term holders staying profitable for an extended period.

Capitulation signals appear earlier than cycle-timing calls

In an interview on Cointelegraph’s Proof of Thesis, James Check described Bitcoin’s February slide toward roughly $60,000 as a “price-pain capitulation.” In his framing, the move reflected investors who bought near prior highs exiting at substantial losses after prices broke down.

Check then identified a second phase of “time-pain capitulation” around approximately $58,000 in June and July. He linked this leg to months of sideways trading that eroded confidence among holders, eventually pushing additional participants to sell rather than wait indefinitely for a rebound.

Importantly, Check argued that the difference between a range like $58,000 and $60,000 is less meaningful than the elapsed time between those levels. He emphasized that the “actual difference” was the six-month separation—suggesting the market experienced a deeper psychological and behavioral reset earlier than many timing models imply.

That view stands in tension with expectations some traders hold regarding an October low based on recurring four-year cycle patterns. Earlier, analyst Benjamin Cowen had pointed to cycle-duration information and the US midterm-election calendar as reasons to anticipate a fourth-quarter bottoming window. Check’s framework effectively says the market may already have completed much of the required capitulation process months before a calendar-driven trough would arrive.

Cost basis and holder behavior: why “selling pressure” may be absorbed

Check claimed that roughly $300 billion in Bitcoin cost basis sat concentrated between $58,000 and $70,000. According to him, around 4 million BTC subsequently moved from unrealized losses into profit during the recovery—an important behavioral milestone because it can alter how investors act.

He also suggested that long-term holders now control about 80% of Bitcoin wealth. In Check’s view, that distribution matters: long-term investors are more likely to wait for substantially higher prices rather than sell after a short-term rebound, which can change the market’s ability to sustain new lows.

Put simply, Check’s argument is that capitulation is not just a price print—it’s a transition in profitability and incentives. When enough coins move from loss to profit and the holder base becomes more stable, the conditions that typically drive further waterfall selling may ease.

Why traders shouldn’t treat the four-year cycle as a rule

Check’s critique went beyond one forecast. He said that anchoring decisions to the four-year cycle is a mistake because there is no mechanical reason for it to repeat.

“Ask, ‘Well, now what do I do?’ long before your compass breaks,” Check said, comparing cycle reliance to a broken clock that is only correct by coincidence. In his view, that mindset encourages traders to look for dates rather than confirm whether capitulation and exhaustion are actually present.

Instead, Check argued traders should evaluate metrics like cost basis distribution, unrealized and realized losses, holder profitability, and whether experienced investors are accumulating or distributing. Calendar dates should only provide context after market evidence indicates exhaustion. “Look for the evidence, not the calendar,” he added.

Grayscale’s Zach Pandl sees a June $58,000 bottom—though data is mixed

Check’s stance aligns with a separate analysis from Grayscale head of research Zach Pandl, who also discussed Bitcoin’s downside trajectory in a recent interview on Cointelegraph’s Trade Secrets. Pandl said he was willing to “stick [his] neck out” and guess that prices bottomed near $58,000 at the end of June.

In his assessment, this bear-market move produced less despair than previous Bitcoin drawdowns, partly because it followed a bull market with less euphoria. Pandl suggested that combination could translate into a more contained decline compared with earlier cycles.

He also pointed to a market behavior test: whether Bitcoin keeps falling after bad news. “When price in an asset class, whether it’s crypto or anything else, stops going down on bad news, that’s usually a sign that it’s oversold,” Pandl said—framing a potential turning point in terms of downside momentum rather than a specific calendar date.

On-chain indicators don’t all agree

Despite the $58,000 bottom thesis, on-chain evidence remains inconsistent across datasets. HODL Waves data showed Bitcoin supply held for one to seven days rose only from 1.97% on July 1 to 2.35% on July 5. Analyst Willy Woo interpreted that as an unusually muted response from dip-buyers, implying limited enthusiasm from short-term participants during that period.

Other analytics point in the opposite direction. CryptoQuant data, as reported by Cointelegraph, showed short-term holders remained partially profitable for 30 consecutive days—described as the longest such stretch in 2026 at the time—alongside a pattern that CryptoQuant said has historically characterized Bitcoin recoveries.

Taken together, the mixed signals suggest that while selling pressure may have eased and profitability dynamics may have improved, participation from new short-term buyers was not uniformly aggressive. That can matter for how quickly liquidity returns and whether any rally can broaden beyond the same cohort of holders.

For investors and traders, the near-term question is less about which date a model prefers and more about whether on-chain profitability transitions continue and whether short-term demand strengthens without relying on calendar coincidences. Monitoring holder cost-basis shifts alongside realized-loss behavior may help clarify whether the market’s “capitulation” phase is truly behind it—or whether another wave of distribution is still possible.

Active chairman

Advertisement

Berkshire Hathaway, long term

Berkshire’s 2026 underperformance

If that’s not enough, the Dollar Index, which measures the dollar against a basket of major currencies, has topped 100, hitting its highest level in over a month. Sustained dollar strength can tighten financial conditions and weigh on risk assets, including bitcoin. Further, the Bank of Japan lifted its benchmark borrowing cost to a 31-year high.

Explaining bitcoin’s resilience to these factors, Sygnum Bank said rising interest rates and bond yields are not always bearish.

“It’s not a one-way street. You see yields rising, and at the same time Bitcoin and gold outperforming. If rising rates are an indication of debasement risk and sovereign counterparty risk, then for store of value assets that is actually a positive driver,” Fabian Dori, chief investment officer at Sygnum, said in an email.

What next?

For bitcoin, the takeaway is its resilience, above $77,000, despite legislative setbacks, rising oil prices, tighter monetary policy and a stronger dollar. In other words, the path of least resistance appears to be higher.

“If the market has been this resilient when the news flow has been challenging, even a modest improvement in macro, geopolitical or regulatory conditions could provide the catalyst for the next major leg higher,” Joel Kruger, Markets Strategist at LMAX Group, said.

State-linked cybercriminals are increasingly using public blockchains as “dead drops” for malware instructions and infrastructure details, according to a new Chainalysis report. The firm estimates that state-aligned actors accounted for roughly two-thirds of new dead drop activity each quarter, while the frequency of these writes rose 420% over the past 12 months.

Chainalysis also reports that operators tied to North Korea and Iran are among the groups adopting the tactic, including activity it linked across multiple networks—Tron, Aptos, and BNB Smart Chain (BSC)—to a North Korea-associated actor tracked by Google Threat Intelligence.

Key takeaways

• Chainalysis says state-linked threat actors drive about two-thirds of quarterly blockchain dead drop activity.
• Blockchain “dead drop” writes climbed 420% year over year, indicating faster growth in on-chain malware infrastructure.
• North Korea-linked groups have used multi-chain routing, with Tron acting as a first route and Aptos as a fallback to a BSC transaction containing encrypted instructions.
• Chainalysis attributes a 440% rise in malicious writes since July 2025 in part to the availability of high-capacity open-source AI models capable of generating malicious code with limited safeguards.
• Iran-linked operators are also suspected of using the Bitcoin blockchain to publish encoded command-and-control routing data that infected devices can poll for updates.

Dead drops across public chains: why it’s hard to shut down

Chainalysis defines the “dead drop” tactic as embedding malware guidance—such as pointers to infrastructure, server addresses, or configuration data—inside transactions on public blockchains. The report highlights a central advantage for attackers: even if domains, servers, or code repositories are taken offline, the stored information can remain publicly accessible on-chain.

The analytics firm warns that this durability makes campaigns more resilient over time and increases the operational burden on defenders. Instead of merely disrupting a single server or endpoint, response efforts may need to account for information that is permanently replicated across decentralized ledgers.

Chainalysis also points to a broader pattern: state actors are not only using blockchains, but increasingly scaling how often they do so and broadening the networks involved.

North Korea-linked activity routed through Tron, Aptos, and BSC

One of the report’s most specific findings ties previously unattributed blockchain activity spanning Tron, Aptos, and BNB Smart Chain to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.

Chainalysis describes how encoded pointers embedded in Tron and Aptos transactions would direct infected devices toward the same BSC transaction. In this setup, Tron served as the first routing path, while Aptos provided a fallback option if the primary route failed.

The shared BSC transaction, Chainalysis says, contained encrypted server addresses and configuration data. That data, once decrypted by compromised devices, connected them to off-chain infrastructure used for remote access and data theft.

For investors and builders, the takeaway is less about any single chain and more about how malware operators are treating blockchain networks as flexible, multi-route messaging systems—one that can help keep campaigns functioning even when certain routes or infrastructure components change.

Chainalysis also notes that public blockchains have previously been used in similar ways by North Korean hackers. In 2025, for instance, coverage from Cointelegraph described a technique called EtherHiding, where malicious crypto-stealing code was placed in smart contracts.

AI’s role: more malicious writes, but attribution remains uncertain

Chainalysis further reports a 440% increase in malicious blockchain writes since July 2025, framing the change as coinciding with when “high-capacity open-source Chinese artificial intelligence models became capable of producing malicious code with limited safeguards,” according to the firm’s findings.

Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that the team observed a “clear point-in-time association” between the period and the surge in malicious on-chain activity. However, he cautioned that the firm could not prove that the actors publishing the malicious transactions and contracts had directly used these AI models to boost their output.

This distinction matters for what readers should infer from the data. The increase suggests that the environment for writing and deploying malicious code may have become easier to scale, but Chainalysis’ evidence does not establish a direct line from a specific model to specific actors. Defenders may still adjust their priorities—especially around how quickly adversaries can publish new payloads—without assuming the attribution is solved.

Iran-linked operations use Bitcoin as an update channel

Beyond non-Bitcoin networks, Chainalysis also identifies threat actors it suspects are linked to Iran’s Ministry of Intelligence. In its assessment, those actors wrote encoded command-and-control routing data to the Bitcoin blockchain.

Chainalysis says its judgment is based on a combination of factors—such as the malware family, the decoding method used, timing patterns, and associated server infrastructure—rather than relying on blockchain activity alone.

The report describes a mechanism where attacker-controlled wallets sent small payments to a well-known Bitcoin address historically tied to Satoshi Nakamoto. Chainalysis states that the address has no connection to the attackers and functions as a permanent public location that infected devices can check for updated instructions.

According to Chainalysis, the attackers can refresh their server infrastructure by publishing a new Bitcoin transaction with updated data. Once malware pulls the new directions, the operation can shift off-chain for follow-on activities that may include remote access, credential theft, and the delivery of additional malware.

By using Bitcoin as a reliable public registry for routing updates, the approach again underscores the same theme: attackers can avoid some traditional single-point failures (like takedowns) by embedding “where to go next” information into data that remains widely available.

Chainalysis’ findings suggest defenders should treat blockchain dead drops as an evolving, potentially scalable part of cyber operations—especially as on-chain writes rise across multiple networks. The key uncertainty readers should watch next is whether future reporting will narrow the gap between association and direct attribution—particularly around AI-assisted scaling—and how quickly defenders and platforms adapt to this more resilient style of malware infrastructure.