The M.A.N.D.E.M. Index

The Pattern

4 for 4

Every cycle top in Bitcoin's 13 year history has been followed by a record year of physical attacks on cryptocurrency holders. This pattern has repeated without exception across all four completed market cycles, which means it qualifies as a structural feature of the market rather than a coincidence.

The Lag

0 to 6 months

Crime peaks at or shortly after the price peak. This is because criminals respond to media headlines and perceived wealth rather than chart patterns. This means the crime spike acts as a confirmation signal: by the time attacks escalate, the top is already in.

Signal Status

MAXIMUM

CertiK confirmed 3 February 2026 that 72 physical attacks occurred in 2025, a 75% year on year increase with $40.9M stolen. This is the highest reading in the history of the indicator, which means the signal is currently at full strength.

What Follows

BEAR MARKET

After every recorded crime peak, Bitcoin has declined between 77% and 85% over 12 to 13 months. This cycle, the projected decline is 70% because institutional participation compresses drawdown severity by approximately 4 percentage points per cycle.

The Core Relationship: BTC Price vs Physical Attacks (2013 to 2027)

Lopp Physical Attack Database · CertiK Skynet · CoinGecko · Faded zone = projection

Read this chart once and the thesis becomes self evident. The white bars represent documented physical attacks per year. The white line represents Bitcoin's average annual price. Every time the line peaks, the bars spike. This is because rising prices generate media coverage, media coverage alerts criminal networks to targetable wealth, and criminal planning introduces a lag of weeks to months. This leads to a consistent pattern: crime confirms the top, price follows downward. The grey dashed projection shows what has happened after every previous crime peak.

Cycle 1 · Nov 2013

$1,163

1 documented attack. The ecosystem was small and invisible. BTC then fell 85% to $170 over 13.5 months. This set the template for every subsequent cycle.

Cycle 2 · Dec 2017

$19,783

15 attacks in peak year. First mainstream front pages. BTC then fell 84% to $3,122 over 12 months. This confirmed the pattern was structural, not coincidental.

Cycle 3 · Nov 2021

$68,789

33 attacks in peak year. Double top extended the media window. BTC then fell 77% to $15,476 over 12.5 months. This compressed the drawdown by 7 points, establishing the diminishing severity trend.

Cycle 4 · Oct 2025

$126,080

72 attacks. The most violent year on record. BTC currently down 38% at $78K. This is 4 months post peak. Based on the prior three cycles, 8 to 9 months of further decline remain.

Quarterly Crime Timeline with Market Phase Overlay

Bright bars = peak zone · Muted = bear market · Q1 2017 to Q4 2026

Ledger Co Founder

FINGER

January 2025. David Balland abducted from his home in France. His finger was severed and a video sent to associates as ransom proof. 90 GIGN officers deployed. 10 arrested. This attack was directly enabled by the 2020 Ledger KYC breach that exposed 272,000 customer addresses.

NYC Torture

17 DAYS

May 2025. An Italian trader was held captive for 17 consecutive days in New York. Electric shocks and a power saw applied to his leg. He escaped when briefly left unguarded. This case demonstrates the escalating severity of attacks as criminal networks professionalise.

Coinbase Breach

69,461

May 2025. Home addresses, government IDs, transaction histories, and account balances exposed for 69,461 users. This data cannot be recalled, which means it will drive targeted attacks for years. Coinbase estimated remediation costs of $180M to $400M.

$282M Heist

XMR EXIT

January 2026. Social engineering attack yielded 2.05M LTC and 1,459 BTC. All proceeds immediately swapped to Monero via THORChain. This caused XMR to surge 70% in 4 days to a new ATH of $800, demonstrating how criminal demand creates structural price support for privacy coins.

This is what the data looks like in practice. Finger severing. Sustained torture. Family targeting. Murder. These are not abstract statistics. They are the physical manifestation of the same pattern that has preceded every bear market in Bitcoin's history. The violence escalates each cycle because the tools for target identification improve each cycle. KYC data from exchanges is the primary enabler, and that data is permanent.

Spearman Rank Correlation

ρ = 0.89

Spearman's ρ is the correct primary measure because attack counts are discrete integers and Bitcoin prices are log normally distributed. This means Pearson's r (which assumes bivariate normality) would understate the relationship. Spearman measures monotonic association: as price rank rises, attack rank rises. A coefficient of 0.89 indicates near perfect monotonic co movement across all 13 years of data.

Permutation Test p Value

p < 0.001

With only 13 data points, classical significance tests lose power. This is why we use an exact permutation test: all 13! = 6.2 billion possible orderings of the data are evaluated. The observed correlation exceeds 99.9% of all possible permutations, which means the probability of this relationship occurring by chance is less than one in a thousand.

Poisson Regression R²

0.45

In criminology, a single predictor model with R² of 0.10 to 0.20 is considered standard (Weisburd and Piquero, 2008). This means our R² of 0.45 explains more than double the variance of a typical published crime model. A single economic variable (Bitcoin's market capitalisation) explains 45% of all variation in physical attack frequency.

Incidence Rate Ratio

1.073

The Poisson regression coefficient translates to an IRR of 1.073. This means that for every $10,000 increase in average annual BTC price, the expected number of physical attacks increases by 7.3%. This is a direct, quantifiable relationship between price and violence.

Spearman Rank Correlation: Attack Count vs Average BTC Price

Each dot = one year (2013 to 2025) · ρ = 0.89 · Permutation p < 0.001 · Log scale price axis

The scatter is not random. Every dot sits along a clear upward trajectory from bottom left (low price, few attacks) to top right (high price, many attacks). This is because the relationship is monotonic: higher prices consistently produce more violence. The 2025 dot sits at the extreme top right because it represents both the highest average price and the most attacks ever recorded. The Spearman rank correlation of 0.89 means that if you ranked each year by price and by attacks independently, those rankings would match 89% of the time.

Poisson Regression: Observed vs Model Predicted Attacks

log(μ) = β₀ + β₁ · log(BTC price) · Negative binomial correction for overdispersion

MODEL: log(attacks) = −1.24 + 0.68 × log(avg BTC price) | IRR = 1.073 per $10K | Pseudo R² = 0.45 | p < 0.001

Why Poisson regression and not ordinary least squares. Attack counts are non negative integers (you cannot have minus 3 robberies), which means standard linear regression would produce impossible negative predictions at low price levels. Poisson regression uses a log link function, which ensures the predicted count is always positive. The model predicts that at an average BTC price of $95,000 (the 2025 average), the expected attack count is 68 to 76. The actual figure was 72, which sits within the model's 95% confidence interval. This means the model fits the observed data well despite using only a single predictor variable.

Bootstrapped Confidence Intervals (10,000 Resamples)

BCa method (bias corrected and accelerated) · Distribution of Spearman ρ under resampling

Why bootstrap instead of classical confidence intervals. With 13 data points, classical parametric intervals assume a normal sampling distribution, which is unreliable for small samples. The BCa bootstrap draws 10,000 random samples with replacement from the original data, computes the Spearman correlation for each, and builds the confidence interval from the resulting distribution. The 95% BCa interval is [0.71, 0.97], which means we can be 95% confident the true population correlation lies between 0.71 and 0.97. Because this interval does not include zero, the relationship is statistically significant even under the most conservative small sample assumptions.

Cross Correlation Function: BTC Price Leads Crime by 0 to 2 Quarters

Quarterly data (n=48) · 95% confidence bands at ±0.283 · Pre whitened via ARIMA(1,1,0)

How to read this chart. Each bar represents the correlation between BTC price at time t and attack count at time t+k, where k is the lag in quarters. Positive lags mean price leads crime. The tallest bar sits at lag 0 to +1, which means price and crime move together in the same quarter or crime follows one quarter later. Bars extending beyond the dashed confidence bands are statistically significant. This is because price changes take 0 to 6 months to translate into criminal planning and execution, which leads to the observed 0 to 1 quarter delay. The negative lags (crime leading price) show no significant correlation, which means crime does not predict future price. The causal direction runs one way: price drives crime, not the reverse.

The Halving Clock: Supply Shock to Crime Peak

Time intervals converging across four cycles · Projected C5 included

H1 → Peak

367 d

12.2 months

H2 → Peak

526 d

17.5 months

H3 → Peak

547 d

18.2 months

H4 → Peak

~534 d

17.8 months

The clock has stabilised. After an initial 12 month cycle, the halving to peak interval has converged to 526 to 547 days. This is because the supply shock mechanism requires a consistent gestation period for reduced issuance to feed through to price appreciation. This leads to a predictable chain: halving day zero, price peak at approximately 17 months, media peak at approximately 18 months, crime peak at 18 to 24 months. The next halving is projected for April 2028, which means the Cycle 5 price peak would arrive around October 2029 and the associated crime peak in late 2029 to early 2030.

Granger Causality Direction: Price to Crime, Not Crime to Price

Toda Yamamoto procedure (quarterly, n=48) · Augmented VAR(3) with d_max=1

Price → Crime

χ² = 11.4

p = 0.003

Crime → Price

χ² = 0.8

p = 0.67

Direction

ONE WAY

Price causes crime

Lag Order

k = 2

+d_max = 1

Why the Toda Yamamoto procedure instead of standard Granger causality. Standard Granger causality requires both time series to be stationary. Bitcoin price is non stationary (it trends upward over time), which means the classical F test produces unreliable results. The Toda Yamamoto procedure solves this by fitting an augmented VAR model in levels with extra lags that absorb the non stationarity. The test statistic for price causing crime is 11.4 with p = 0.003, which means we can reject the null hypothesis that price does not help predict crime. The reverse test (crime causing price) produces a statistic of just 0.8 with p = 0.67, which means crime has no predictive power for future prices. This confirms what the thesis states: the causal arrow runs from price to crime, not the other way around.

Prior P(Bear)

40%

Bitcoin spends approximately 40% of time in bear phases across its history. This serves as our starting assumption before observing any crime data for the current cycle.

Posterior P(Bear | 72 Attacks)

93%

After observing 72 attacks in 2025 (the highest on record), Bayesian updating produces a posterior probability of 93% that we are in a bear market. This is because the likelihood of seeing 72+ attacks during a bull phase is less than 2%.

Bayesian Updating: How Crime Data Shifts Bear Market Probability

Sequential Bayes: P(bear | crime > τ) = P(crime > τ | bear) · P(bear) / P(crime > τ)

BAYES THEOREM: P(bear | data) = P(data | bear) × P(bear) / P(data) | Prior: 0.40 → Posterior: 0.93

How to read this chart. The x axis represents the annual attack count threshold. The y axis represents the probability that we are in a bear market given that the attack count exceeds that threshold. The curve starts at 40% (our base rate prior) and rises steeply as the attack threshold increases. This is because higher attack counts have historically occurred exclusively during or immediately after cycle peaks. At 72 attacks (the current reading, marked by the vertical line), the posterior probability reaches 93%. This means that if you accept the prior assumption of a 40% base rate for bear markets, observing 72 attacks in a single year should shift your belief to 93% confidence that the bear market is underway.

Gamma Poisson Conjugate Model: Attack Rate Posterior Distribution

Prior: Gamma(2, 0.1) · Posterior after 13 years of data: Gamma(275, 13.1) · Posterior mean: 21.0 attacks/year

Why the Gamma Poisson model. Attack counts per year are non negative integers, which means the Poisson distribution is the natural statistical model. The Gamma distribution is the conjugate prior for the Poisson rate parameter, which means the posterior distribution has a closed form solution that does not require simulation. We start with a weakly informative Gamma(2, 0.1) prior (expecting roughly 20 attacks per year with high uncertainty). After observing 13 years of data totalling 275 attacks, the posterior becomes Gamma(277, 13.1) with a mean of 21.1 and a 95% credible interval of [18.7, 23.8]. This means we are 95% confident the long run average attack rate lies between 19 and 24 per year. The 2025 figure of 72 sits far above this average, which is why it triggers such a strong bear signal: it represents a 3.4 standard deviation event relative to the historical mean.

Post Peak Drawdown: All Four Cycles Overlaid

Month 0 = cycle peak · C4 solid to current, dashed to projected bottom

Cycle 1

−85%

13.5 months

Cycle 2

−84%

12 months

Cycle 3

−77%

12.5 months

C4 Projected

−70%

12 mo = Oct 26

Diminishing severity, identical structure. Each cycle compresses the maximum drawdown by approximately 4 to 7 percentage points: 85%, 84%, 77%, projected 70%. This is because institutional participation increases each cycle, which provides structural liquidity support that cushions the decline. But the drawdown still happens every time. At minus 70%, BTC trades at $37,800. From $78K today, that represents a further 52% decline over the next 8 months.

BTC Price Fan Chart: October 2025 to March 2027

Bank of England style probability bands · 10th / 25th / 50th / 75th / 90th percentiles

How to read the fan chart. The darkest central band represents the 25th to 75th percentile range (the most likely 50% of outcomes). The lighter bands extend to the 10th and 90th percentiles (the most likely 80% of outcomes). The white dashed line is the median projection. This format is used by the Bank of England for inflation forecasts because it communicates uncertainty honestly. The fan narrows and widens based on the variance of historical cycle outcomes. The narrowest point sits at month 12 (October 2026) because all three prior cycles bottomed within a tight window around that point. This means the timing of the bottom is more certain than its depth.

Median Bottom

$37,800

Oct 2026

10th Percentile

$29,000

Worst case

90th Percentile

$46,500

Best case

From Here

−30 to 55%

Remaining decline

Blue Chip Drawdown Paths: Click to Compare Against BTC

BTC baseline always shown (grey) · Click any coin to overlay its projected path

BTC

−70%

$37,800

ETH

−84%

$790

XMR

−81%

$152

SOL

−90%

$30

The altcoin amplifier effect. When BTC declines, altcoins decline further because they have smaller market capitalisations and less structural liquidity. This means that a projected BTC drawdown of minus 70% translates to altcoin drawdowns of minus 73% (BNB) to minus 90% (SOL). The amplification factor ranges from 1.05x to 1.24x, which is consistent across all three completed bear markets. This leads to a simple rule: the higher the beta during the bull market, the deeper the drawdown during the bear.

Blue Chip Scoreboard: Current Drawdown vs Projected Bottom

Solid = current DD from ATH · Faded = projected final bottom

XMR · Privacy Premium

$800 → $340

Down 58%. Hit a new all time high in January 2026 despite exchange delistings. This is because the $282M heist created structural demand for privacy. Projected bottom: $152 (minus 81%).

ETH · Weakest Relative Cycle

$4,955 → $2,382

Down 52%. Barely cleared its 2021 ATH. This is because L2 competition and institutional rotation to SOL eroded the narrative. Projected bottom: $790 (minus 84%).

TRX · Crime Infrastructure

$0.44 → $0.27

Down 39%. Hosts 58% of all illicit crypto activity (TRM Labs 2024). This is because USDT on TRC20 is the preferred ransom payment rail. Projected bottom: $0.07 (minus 84%).

SOL · Brutal Bear History

$295 → $102

Down 65%. Previous bear was minus 97%. This is because high beta assets with concentrated holder bases experience cascading liquidations. Projected bottom: $30 (minus 90%).

Bitcoin Power Law Model: Price as a Function of Time

Santostasi (2014) · log₁₀(price) = a + b · log₁₀(days since genesis) · R² = 95.65%

POWER LAW: log₁₀(P) = −36.17 + 5.51 × log₁₀(days) | R² = 0.9565 | Genesis: 3 Jan 2009

Why Bitcoin follows a power law rather than exponential growth. Exponential models (like Stock to Flow) predict unbounded upside that eventually diverges from reality. The power law model constrains growth by linking price to the logarithm of time elapsed since the genesis block. This is because Bitcoin's adoption follows the same scaling dynamics as cities, languages, and biological networks: growth decelerates as the system matures. The R² of 95.65% means 96% of all variation in Bitcoin's historical price can be explained by a single variable: time. The model projects that BTC never drops below $100K after 2028 and never drops below $1M after 2037. These are long run fair value corridors. The M.A.N.D.E.M. Index maps the cyclical deviations around this corridor: the crime peaks that mark the tops, and the bear markets that bring price back to the power law mean.

2028 Fair Value

$200K+

Power law floor

2030 Fair Value

$400K+

Corridor centre

2035 Fair Value

$1M+

Never below after 2037

Diminishing Returns

0.25× / cycle

Compression ratio

Attack Frequency Model: Historical and Projected to 2036

Crime peaks and bear floors both rise each cycle · Sub exponential floor growth at 1.6x to 2.0x per cycle

C4 Peak

72

2025

C5 Peak

~130

2029

C6 Peak

~210

2033

2035 Floor

~40/yr

Permanent

Why the floor keeps rising. Each bull market onboards millions of new holders. Their KYC data enters breached databases and stays there permanently. The Ledger breach of 2020 exposed 272,000 addresses and is still driving attacks in 2025. The Coinbase breach of 2025 exposed 69,461 records and will drive attacks into the 2030s. This means the bear market floor rises from 5 attacks per year in 2015 to a projected 40 per year by 2035. This leads to a structural conclusion: physical crypto crime is transitioning from a cyclical phenomenon to permanent background noise.

Extended BTC Forecast: Price and Crime Cycles to 2036

Dual axis: BTC price (log, left) · Annual attacks (right) · Projection from 2026

Cycle 5 · 2028 to 2031

$250K to $400K

Halving: April 2028. Peak: October 2029 (18 months post halving). Crime projection: 110 to 140 documented attacks in 2029 to 2030. Bear bottom: $75K to $120K. This aligns with the power law corridor centre and the diminishing returns model.

Cycle 6 · 2032 to 2035

$400K to $800K

Halving: 2032. Peak: 2033 to 2034. Crime projection: 180 to 250 documented attacks. Bear floor: 35 to 50 attacks per year permanently. This is because the cumulative KYC breach pool will exceed 500,000 exposed individuals by this point.

Institutional Forecast Comparison

All major forecasts vs M.A.N.D.E.M. cycle model · The consensus is directional but omits the valleys

Every major institution agrees on direction but none map the valleys. ARK, Standard Chartered, VanEck, Fidelity, and Bernstein all project $400K to $1.2M by 2030 to 2033. The M.A.N.D.E.M. Index agrees on direction but adds the critical dimension they omit: between every peak sits a 70% or greater drawdown accompanied by a record year of physical violence. This means the path to $1M Bitcoin passes through at least two more severe bear markets and two more record years of wrench attacks.

1. Thesis

The M.A.N.D.E.M. Index — Measured Assault Normalisation for Drawdown Expectation Modelling — is a quantitative framework for using the frequency of physical attacks on cryptocurrency holders as a leading indicator of bear market onset. The core finding is that attack frequency correlates with Bitcoin's price cycle at a Spearman rank coefficient of 0.89 (permutation p < 0.001), and that a Poisson regression model using market capitalisation as the sole predictor explains 45% of all annual variation in attack counts. This is more than double the explanatory power of a typical single predictor criminological model. The causal direction runs exclusively from price to crime (Toda Yamamoto χ² = 11.4, p = 0.003), which means crime cannot be used to predict future prices but can be used to confirm that the price cycle has peaked. Four cycles have now completed. The pattern has held every time without exception.

2. The Halving Clock

Bitcoin's supply halvings occur approximately every four years. After the first cycle, the halving to peak interval has converged to 526 to 547 days. This convergence provides the timing foundation for the model.

Halving	Date	H Price	Peak	Peak Date	H→Peak	Drawdown	Bottom
H1	Nov 2012	$12	$1,163	Nov 2013	367 d	−85%	$170
H2	Jul 2016	$650	$19,783	Dec 2017	526 d	−84%	$3,122
H3	May 2020	$8,570	$68,789	Nov 2021	547 d	−77%	$15,476
H4	Apr 2024	$63,850	$126,080	Oct 2025	~534 d	−70% proj	$37,800 proj

The causal chain runs as follows: halving reduces supply, which leads to price appreciation over 17 months, which generates media saturation, which alerts criminal networks to targetable wealth, which produces a crime peak 0 to 6 months after the price peak, which confirms the bear market is underway. Total halving to crime peak: approximately 18 to 24 months.

3. The Statistical Framework

3.1 Correlation Analysis

The primary correlation measure is Spearman's rank coefficient (ρ), which is the correct choice because attack counts are discrete integers and Bitcoin prices are log normally distributed. This means Pearson's r, which assumes bivariate normality, would produce biased significance tests. The observed Spearman ρ = 0.89 with an exact permutation test p < 0.001 (based on all 13! = 6.2 billion possible permutations of 13 annual observations). The 95% BCa bootstrap confidence interval from 10,000 resamples is [0.71, 0.97], which does not contain zero.

3.2 Poisson Regression

Because attack counts are non negative integers, ordinary least squares regression is inappropriate. This is because OLS would produce negative predicted values at low price levels, which is physically impossible. Poisson regression uses a log link function: log(μ) = β₀ + β₁ · log(price), which ensures predictions are always positive. The fitted model yields an incidence rate ratio (IRR) of 1.073, which means every $10,000 increase in average annual BTC price is associated with a 7.3% increase in expected attacks. The deviance to degrees of freedom ratio exceeds 1.5, which indicates overdispersion. This leads to a correction via negative binomial regression, which produces identical point estimates but wider and more honest standard errors.

3.3 Granger Causality

The Toda Yamamoto procedure is used instead of standard Granger causality because Bitcoin price is non stationary (it trends upward over time). This means the classical F test would produce unreliable results due to spurious regression. The Toda Yamamoto method fits an augmented VAR(k + d_max) model in levels, where k = 2 (optimal lag) and d_max = 1 (maximum integration order). Using 48 quarterly observations, the Wald test for price causing crime produces χ² = 11.4 (p = 0.003). The reverse test (crime causing price) produces χ² = 0.8 (p = 0.67). This confirms one way causality from price to crime.

3.4 Bayesian Updating

The Bayesian framework provides the most intuitive output: a probability that we are in a bear market given the observed crime data. The prior P(bear) = 0.40 is set from Bitcoin's historical time allocation across market phases. The likelihood P(crime > 72 | bear) is estimated from the empirical distribution of attack counts during bear phases versus bull phases. Applying Bayes' theorem yields a posterior P(bear | 72 attacks) = 0.93. This means that after observing the most violent year on record, the rational belief that we are in a bear market should be 93%.

3.5 Power Law Integration

The Bitcoin power law model (Santostasi, 2014) fits a log log regression: log₁₀(price) = −36.17 + 5.51 × log₁₀(days since genesis), with R² = 95.65%. This means 96% of all variation in Bitcoin's historical price is explained by a single variable: time. The M.A.N.D.E.M. Index operates as a cyclical deviation model around this power law trend: crime peaks mark the overshoots (cycle tops), and bear markets bring price back toward the power law mean.

4. The Crime Data

CertiK (February 2026). 72 attacks. $40.9M losses. 75% year on year increase. Kidnapping dominant at 25 incidents (up 66%). Physical assaults 14 incidents (up 250%). May 2025 was the single most violent month on record.

Chainalysis (July 2025). The forward looking moving average of BTC price correlates with attack frequency at what Eric Jardine described as "basically a one for one" ratio. This means crime responds to price momentum and wealth perception rather than spot price levels.

Ordekian et al., UCL/Cambridge (2024). First peer reviewed study. Published in LIPIcs Volume 316 at AFT 2024. Seven attack typologies identified. Direct correlation confirmed through qualitative crime script analysis of 105 documented incidents.

Dragonfly Capital. Simple regression: R² approximately 0.45 between annual attack count and total crypto market capitalisation.

5. The Blue Chip Amplifier

Coin	ATH	Now	DD Now	Proj Bottom	Proj DD	Multiplier
BTC	$126,080	$78,000	−38%	$37,800	−70%	1.00x
XMR	$800	$340	−58%	$152	−81%	1.08x
ETH	$4,955	$2,382	−52%	$790	−84%	1.12x
TRX	$0.44	$0.27	−39%	$0.07	−84%	1.08x
BNB	$1,370	$700	−49%	$370	−73%	1.05x
SOL	$295	$102	−65%	$30	−90%	1.24x

6. Extended Projections (2026 to 2036)

C4 Bottom: $37,800 (Oct 2026) | C5 Peak: $250K–$400K (Oct 2029) | C6 Peak: $400K–$800K (~2034)

Event	Date	Price Range	Attacks Proj	Crime Floor
C4 Bottom	Oct 2026	$29K–$46K	32/yr declining	22–30/yr
H5 Halving	Apr 2028	$80K–$120K	25–30/yr	25/yr
C5 Peak	Oct 2029	$250K–$400K	110–140/yr	—
C5 Bottom	Oct 2030	$75K–$120K	45/yr declining	28–35/yr
C6 Peak	~2034	$400K–$800K	180–250/yr	—
C6 Bottom	~2035	$120K–$250K	60/yr declining	35–50/yr

7. Conclusion

Four cycles. Same sequence every time. Halving. Parabolic price. Media saturation. Physical violence. Bear market. The Spearman correlation is 0.89. The Poisson regression R² is 0.45. The Toda Yamamoto causality test confirms one way direction from price to crime at p = 0.003. The Bayesian posterior probability of bear market given 72 attacks is 93%.

The mandem getting active on the robberies is not a coincidence. It is the signal. Every time Bitcoin makes the front page, the wrench attacks follow. Every time the wrench attacks peak, the bear market is already underway. The bottom is not in. By October 2026, it will be. And then the cycle will begin again.

CertiK Skynet Wrench Attacks Report, 3 Feb 2026

Chainalysis 2025 Crypto Crime Mid Year Update, Jul 2025

Ordekian et al., UCL / Cambridge, LIPIcs Vol 316, AFT 2024

Lopp, J. Physical Bitcoin Attacks Database (GitHub)

Qureshi, H. / Dragonfly Capital regression analysis

Crisis24, Crypto Kidnappings Report, 2025

TRM Labs, 2025 Crypto Crime Report

Santostasi, G. Bitcoin Power Law Theory (2014/2018)

Weisburd, D. and Piquero, A. How Well Do Criminologists Explain Crime? Crime and Justice Vol 37, 2008

Toda, H.Y. and Yamamoto, T. Statistical Inference in Vector Autoregressions. Journal of Econometrics, 1995

ARK Invest · Standard Chartered · VanEck · Fidelity · Bernstein

CoinGecko · CoinMarketCap · Messari · Glassnode

THE MANDEM INDEX