Q3 2026 in Review: Bitcoin's Best Summer Since 2017. Custody's Worst

Bitcoin closed the third quarter of 2026 up roughly 43% — its best third quarter since 2017 and its best quarter of any kind since late 2024. Ether did better still, up around 71%. And it came straight after two losing quarters: Bitcoin fell about 22% in Q1 and another 14% in Q2.

Over the same thirteen weeks, two long-running exchanges closed, a hardware-wallet flaw drained thousands of bitcoin from people who had done everything right, a regulated on-ramp leaked its customers' identities, and a major exchange lost hundreds of millions and froze withdrawals.

That is the quarter in one sentence: the price story and the custody story ran in opposite directions. We wrote about both as they happened. This is the whole quarter in one place.

July: fear, a box, and the first closures

Q3 opened in gloom. Spot Bitcoin ETFs had just had their worst month on record. MiCA's deadline pushed Binance and USDT off licensed EU venues, and the first casualty of Europe's licensing wall, AscendEX, died with user funds inside. Bitcoin had spent 307 days in the same $10,000 box, and in Washington the CLARITY Act stalled — it would ultimately fail before recess.

Then the exits began. On a single day, $686 million of bitcoin left the largest exchanges. Three days later BitMEX announced it was closing, and three days after that BitMart followed — two exchanges scheduling their own ends in one week. Meanwhile, on the other side of the ledger, a self-custodial wallet crossed 100 million users, with daily payment users outnumbering traders for the first time.

Self-custody's own failure modes

It would have been easy to write the quarter as "leave the exchange and you're safe." The quarter didn't allow it. A lawsuit alleged a counterfeit wallet app stayed on a major app store after a six-figure theft. Days later, a flaw in seed generation let attackers sweep 594 BTC from Coldcard wallets in 25 minutes — a total that roughly tripled within a week, as multiple groups worked the same weakness and newer models turned out to be affected too.

The lesson we drew then still stands: cold storage didn't fail, randomness did. The defences that held — a passphrase, dice entropy, multisig across vendors — all refused to let one implementation be the only source of security.

August: the box breaks

On 21 August, the 307-day range broke. Bitcoin cleared $77,000 in its best week in two years — triggered not by anything in crypto, but by the US Treasury doubling its bond buybacks, and amplified by a record wave of short liquidations. The "debasement trade" came back into fashion, and we checked it against the year-to-date numbers: one week of moving with gold is not the same as doing gold's job.

The rally carried Bitcoin to an eight-month high near $87,400 in September before it cooled, as Treasury yields climbed and the Federal Reserve raised rates on 16 September for the first time since 2023. Even after its best summer in nine years, Bitcoin ended the quarter still roughly a third below last October's all-time high and slightly down for the year.

Privacy coins had a quarter of their own

In July we called privacy coins 2026's quiet bull market and named Zcash's Ironwood upgrade as the test to watch. It passed: after a proof-circuit flaw that could have allowed counterfeit coins, Zcash sealed a $1.7 billion pool and installed a turnstile that traps any fake coins inside. The market answered — ZEC went from around $400 to above $1,600 and into the top ten.

THORChain shipped v3.20 with native Monero and Zcash support on the way, after recovering from a May exploit. And for anyone searching for a Monero target, we read the forecasts: five predictions for the same month, $138 apart, which says more about forecasting than about Monero.

On the engineering side, the most interesting thing of the quarter cost 10,000 satoshis: the first quantum-safe Bitcoin transaction, mined in August with no soft fork — expensive, awkward and limited, but proof that an emergency path exists before the emergency.

September: identities, a deadline and a freeze

September brought the breach that complicated our own argument. A Swiss non-custodial service was compromised — no keys taken, no coins at risk, and 5,411 customers exposed anyway, some with their real identities now permanently linked to the Bitcoin addresses they used. Non-custodial protects your coins. It does nothing for your identity.

Then the deadlines arrived. BitMEX closed on 23 September, eleven years after it invented the perpetual swap, with a $50-minimum annual fee waiting on any balance left behind. The next day, Bitget lost hundreds of millions from its hot wallets and froze withdrawals — while the same company's self-custodial wallet carried on untouched, because there was nothing in it to take. Bitget has since begun a phased restart of withdrawals.

What the quarter actually taught

Not that crypto is unsafe, and not that self-custody is a magic word. The quarter's lesson is narrower and more useful: every layer between you and your coins failed somewhere this summer — exchanges, hardware, app stores, compliance databases, even the routes an aggregator depends on. What differed was what you could do about it.

The Coldcard flaw came with an advisory and a migration path. The Pocket Bitcoin breach came with a clear account of who was affected. Bitget's self-custodial users had nothing to do at all. But when an exchange closes or freezes, there is no checklist that gets your coins out faster — you wait on someone else's timeline. A 43% quarter doesn't change that. It only raises what's at stake inside the parts of the system that were already fragile.

Our own quarter, for the record

We hold others to a standard of disclosure, so here is ours. In August we suspended NEAR Intents after a user's swap stalled without settling or refunding and others reported the same. That removed Zcash from our site for six weeks — during which it roughly quadrupled. It is back now, through Changee. We also cut our fee to a flat 1%, and every swap now gets its own private status link.

What to watch in Q4

No predictions — we spent a whole post explaining why they don't work. But a few things are worth watching, because they will matter whichever way prices go:

• BitMart's wind-down runs to 31 January 2027. If you still hold anything there, the same checklist we published for BitMEX applies, with more time on the clock.
• Bitget's recovery — how fully withdrawals resume, and what the investigation finds.
• THORChain's Zcash pool. When it goes live, Zcash gets a protocol route with no company in the middle — and the comparison on our site widens.
• Rates and yields. The rally cooled exactly when yields rose and the Fed hiked. Whatever the Fed does next will likely matter more to Bitcoin's price than anything in crypto.

Whatever Q4 brings, the advice that held all summer still holds: keys in your own custody, backed up offline; a fresh address for every receive; and a test amount before anything that matters. When you need to move between assets, TokensFund compares THORChain, Chainflip, Changee and CCE.Cash on every swap and routes wallet to wallet — no account, no KYC for standard swaps, flat 1% inside the quote.

A note on risk

Nothing here is financial advice and nothing here is a price prediction. Quarterly figures reflect market reporting at the close of 30 September 2026 and vary slightly between data sources. Details of each event are covered, with their own caveats, in the linked posts. Crypto assets are volatile; size positions so that being wrong is survivable.