Regime Detection in Digital Asset Markets

1. Introduction

Digital asset markets change character often. Since 2015, bitcoin's realised volatility and its correlation with US equities have each moved through wide ranges. So has the funding rate paid between long and short holders of perpetual futures, in the public data available from 2019. An allocator running several systematic strategies on these markets needs to know which conditions hold now, how long such conditions tend to last and how quickly a change can be recognised. This paper calls that knowledge a regime estimate.

A regime is a period in which a market's statistical behaviour is stable enough to describe with one set of parameters. The modern econometric approach is usually traced to Hamilton (1989), who treated the parameters of a time-series model as the outcome of an unobserved Markov process. The regime has to be inferred, with error, and the inference available on the day differs from the one available later. This paper measures what that means in crypto, using public data and three signal families: volatility (realised and implied), correlation (within crypto and with US equities) and perpetual funding rates.

Four results run through the paper. Crypto regimes are mainly volatility states, as Ang and Timmermann found for traditional assets. They are short, lasting days and weeks rather than the months and years typical of equity regimes. The level of volatility that counts as high has drifted down, so any fixed threshold is a choice of era. And real-time detectors trade speed against false alarms, to a degree that depends on what is counted as a regime. No single signal family catches every kind of stress: funding was elevated before the leverage unwinds of 2020 and 2021 but not before the credit and venue failures of 2022. Section 5 turns these results into a general framework for regime-conditioned allocation.

Every figure in this paper is either a market statistic computed from public data, by the method in Section 3, or a figure cited from a named source. The regime classifications are illustrative frameworks built for this paper. They are not Hedgehog's model. The paper reports no strategy, portfolio or backtest results and does not convert market statistics into position outcomes. Academic studies that report such results are described qualitatively.

Hedgehog Capital is an AI-first global macro research-and-risk service for professional and high-net-worth investors. It is not available to retail investors or to US citizens or residents. Clients keep their capital on their own exchange accounts at Kraken, Coinbase, Deribit, Binance or Hyperliquid, where each client's dedicated Hedgehog AI trades. Hedgehog never holds client assets and is not a fund. As published on its site, Hedgehog refreshes its regime estimate every day "across cross-asset signals, realised volatility, and spread behaviour", and risk itself is monitored in real time. This paper does not describe Hedgehog's implementation beyond its published text.

2. Background and evidence

Regime-switching models. Hamilton applied his model to post-war US output, inferring shifts between expansion and recession probabilistically, and linked a typical recession to a permanent loss of about 3% of GNP. In a later survey he distinguishes filtered probabilities, which use data up to the date in question, from smoothed probabilities, which use data up to a later date and so are not available in real time. He also argues that models should usually allow a return to the earlier regime, because crises are not permanent.

Ang and Timmermann make three points that shape this paper. Regimes in asset returns are mostly identified by volatility: in their two-regime model of monthly US equity excess returns from 1953 to 2010, they cannot reject equal means across regimes but do reject equal volatilities. The number of regimes is hard to choose, because standard likelihood ratio tests do not apply. And in a simulated example, real-time (filtered) inference tracks the regime well but at times misses an important regime change and at other times issues false alarms. Their equity regimes are long: monthly persistence parameters of 0.9770 and 0.9512 imply expected durations of roughly 43 and 20 months (our arithmetic: one divided by one minus the persistence).

Regimes matter for allocation because correlations and volatilities shift together. Ang and Bekaert (2002) find that international equity correlations rise in highly volatile bear markets, and that the costs of ignoring regimes are small for all-equity portfolios but larger when an asset that is riskless over the next period can be held. A companion paper reaches a similar conclusion. For a crypto allocator, the closest analogue is the choice between running a strategy at full size, at reduced size or not at all.

Fitted regimes are not fixed. Rydén, Teräsvirta and Åsbrink show that a hidden Markov model reproduces most stylised facts of about 17,000 daily S&P 500 returns, but that its parameter estimates sometimes differ considerably between subperiods. Nystrup, Madsen and Lindström show that letting a two-state Gaussian model's parameters vary over time reproduces the long memory of squared daily returns and improves one-step density forecasts. Both support refitting through time.

Volatility clustering. Engle describes volatility clustering: risky periods are not scattered at random. The GARCH model of Bollerslev lets today's conditional variance depend on past variances. Lamoureux and Lastrapes showed that GARCH persistence is overstated when shifts in the level of variance are left out of the model. For bitcoin, Ardia, Bluteau and Rüede find strong evidence of regime changes in GARCH volatility dynamics, and a Markov-switching specification forecasts one-day value-at-risk better than a single-regime model.

Crypto regimes and cross-asset links. Koki, Leonardos and Piliouras find that a four-state non-homogeneous hidden Markov model, whose transition probabilities depend on financial, economic and crypto-specific predictors, forecasts best one step ahead among the models they compare and separates bull, bear and calm regimes for bitcoin, a sign that two states may be too few. The link to equities has changed. Liu and Tsyvinski, with data to 2018, found that cryptocurrencies had no exposure to most common stock market and macroeconomic factors. The IMF later reported that the bitcoin-S&P 500 correlation rose from 0.01 in 2017 to 2019 to 0.36 in 2020 to 2021, and that spillovers tend to increase in episodes of financial market volatility. Iyer and Popescu find that spillovers intensify in turbulent periods and run mostly from crypto to financial markets, though the direction can reverse under financial stress.

Leverage and funding. In a BIS working paper, Schmeling, Schrimpf and Todorov show that the crypto futures basis, which they call crypto carry, can reach up to 60% a year. They attribute it to trend-chasing demand for leveraged upside meeting scarce arbitrage capital, find that high carry predicts future price crashes, and note that margins spike and liquidations cluster in drawdowns. He, Manela, Ross and von Wachter show perpetual funding turning substantially negative on most exchanges in March 2020, highly positive in early 2021 and significantly negative on all solvent exchanges during the FTX insolvency in November 2022. Brunnermeier and Pedersen explain how market and funding liquidity reinforce each other in liquidity spirals, and Geanakoplos argues that leverage becomes too high in booms and too low in bad times.

Correlation in stress. Longin and Solnik find that large negative equity returns are much more correlated than a normal model implies, while large positive returns are not. They also warn that correlation measured in volatile periods (large absolute returns) is higher than in tranquil ones even when the true correlation is constant. Forbes and Rigobon show that unadjusted correlation is biased upward when volatility rises. Section 4 applies both checks to bitcoin.

3. Data and method

Data. All data are public and were downloaded without keys. Daily BTC-USD closes come from the Coinbase Exchange candles API (20 July 2015 to 25 October 2026, 4,116 closes, none missing) and ETH-USD closes from 1 June 2016. Kraken bitcoin closes from its OHLC API, which returns the last 720 days, agree with Coinbase within 10.7 basis points. Deribit's DVOL index, from its volatility index API, covers 24 March 2021 to 25 October 2026. Perpetual funding comes from Binance (BTCUSDT from 11 September 2019), Bybit (from 26 March 2020), Deribit (from 2 May 2019), OKX (97 days, the three months its API returns) and Kraken Futures (375 days, from 16 October 2025). S&P 500, Nasdaq Composite and VIX closes come from FRED. Data run through 25 October 2026 unless stated.

Conventions. The daily change is the log of the close-to-close ratio at 00:00 UTC. Percentage changes quoted for single days and events are simple price changes. Realised volatility over n days (RV7, RV30) is the square root of 365/n times the sum of the last n squared daily log changes, in annualised volatility points, matching DVOL's 365-day calendar. Calendar-year and full-sample volatilities are the annualised standard deviation of daily log changes, over 365 days for crypto and 252 trading days for equities. Exponentially weighted moving average (EWMA) volatility uses the RiskMetrics decay of 0.94. Funding prints are summed by the UTC day in which each accrual interval ends; the annualised funding rate is that sum times 365. Positive funding means longs pay shorts. Funding is reported here as a market rate, not as the outcome of holding any position. Equity correlations use US trading days, with bitcoin sampled three to four hours after the US close; weekly correlations check this asynchrony. Windows on US data, such as the 90-day correlation windows, count US trading days. The bitcoin-ether correlation uses all calendar days.

Signal families. Volatility signals are RV7, RV30, EWMA volatility and DVOL, a 30-day forward-looking implied volatility built with a variance swap methodology from the two expiries bracketing 30 days, recalculated every second and published as an exponential moving average. Correlation signals are bitcoin's correlation with the S&P 500 and Nasdaq, conditioned on year, the VIX and bitcoin's own state, and its correlation with ether. Funding signals are perpetual funding rates on five venues.

Illustration 1: a rule-based grid. The first classifier crosses a volatility state, the tercile of bitcoin's RV30 over the grid sample (cut-offs 44.1 and 60.7), with a funding sign, the sign of the 7-day average of Binance BTCUSDT funding. It runs from 18 September 2019 to 25 October 2026 (2,595 days). A real-time variant uses expanding-window terciles of RV30 from July 2015, with at least 365 days of history, so that each label uses only data available at that day's close.

Illustration 2: hidden Markov models. The second classifier fits Gaussian hidden Markov models (HMMs) with two and three states to bitcoin's daily log changes from 21 July 2015 to 25 October 2026 (4,115 days), by expectation-maximisation with 12 seeded random starts (8 for the year-end refits). Smoothed paths use the whole sample and give the hindsight view. Filtered paths use data only to each day, but with full-sample parameters they still draw on later data through the parameters. Real-time variants are therefore refitted at each year-end on data to that date and run forward through the next year. The models see only bitcoin prices; funding and correlation enter only as descriptions by state.

Detection test and event study. The hindsight reference is the turbulent state of the smoothed three-state model, with calm and normal merged. Each real-time signal labels a day turbulent using data to that day's close; volatility signals do so when in their real-time top tercile. Lag is the number of days from the start of a reference spell to the first day the signal agrees. A false alarm is a signal spell that overlaps no reference spell. The event study examines seven UTC dates. Where a source dates an episode only to a month, the paper uses the first day in that month with a bitcoin price fall of more than 9%: 9 May 2022 for TerraUSD and 8 November 2022 for FTX, where a larger fall followed on 9 November. For Celsius, 13 June 2022 is the first full UTC day after Sunday 12 June 2022, the date on which, according to the SEC's complaint, Celsius effectively halted its platform. These are descriptions of market conditions, not trading rules.

4. Findings

4.1 Volatility clusters, and its level moves. Over 4,115 daily changes from 21 July 2015 to 25 October 2026, bitcoin's annualised volatility was 66.8%, skewness -0.68 and excess kurtosis 13.5. The lag-1 autocorrelation of daily changes was -0.05, while that of absolute changes was 0.21 at lag 1 and still 0.03 at lag 100. The Ljung-Box Q(20) statistic was 32.3 for daily changes (p = 0.04) and 1,494.8 for absolute changes (p < 0.001). Magnitudes cluster far more than directions. Price moves larger than 10% in either direction occurred on 2.3% of days; the largest fall was a price change of -38.8% on 12 March 2020. Ether's annualised volatility was 92.7%.

Full-sample figures mix very different markets (Table 1). Bitcoin's realised volatility exceeded 80% in 2017, 2018, 2020 and 2021, and was between 41.9% and 53.0% in each year from 2023. Kaiko reported bitcoin's 60-day volatility below 50% from early 2023 to mid-2024, against peaks above 100% in 2021 and 2022. DVOL averaged 91.8 in 2021 and 42.5 in 2026. Correlation and funding moved too, but not in step with volatility. Bitcoin's S&P 500 correlation peaked at 0.56 in 2022, a year of middling crypto volatility, and was 0.42 or higher in 2025 and 2026 with volatility near its lows. Mean funding peaked at 30.6% annualised in 2021.

Single-regime volatility models struggle with this shift. In GARCH(1,1) fits with Gaussian errors, persistence is 0.9739 over the full sample, above its level in every subperiod: 0.9600 in 2015 to 2019 (half-life 17.0 days) and 0.8517 in 2023 to 2026 (4.3 days). With Student-t errors, persistence over 2023 to 2026 is still 0.9909 (half-life 76 days), so the decline depends on the error distribution. A Student-t fit over the full bitcoin sample is effectively integrated, with persistence at the estimation's upper bound of 0.9999. This is the pattern Lamoureux and Lastrapes describe when the level of variance shifts and the model ignores it, and it supports models that let the level switch, as Ardia and co-authors propose.

4.2 Implied volatility carries information about the month ahead. Bitcoin's DVOL averaged 59.5 from 24 March 2021 to 25 October 2026, ranging from 32.4 (12 August 2023) to 156.2 (23 May 2021), and stood at 38.8 on 25 October 2026. Its correlation with RV30 was 0.81 on the same day, 0.81 and 0.79 with RV30 measured five and ten days later, and 0.76 and 0.72 with RV30 measured five and ten days earlier. RV30 a few days ahead still consists mostly of days already past, so these figures show alignment more than foresight. Against realised volatility over the next 30 days alone, DVOL's correlation was 0.61, against 0.41 for current RV30, and adding DVOL to current RV30 raises the share of next-month variation explained from 16% to 39%.

DVOL minus realised volatility over the next 30 days averaged +8.2 points over 2,012 days, with a 10th percentile of -13.4 and a 90th of +27.7. The gap averaged +17.8 in 2021, between +6.4 and +12.1 from 2022 to 2025, and -0.4 in 2026 to late September. Ether's gap averaged +4.3. The gap mixes a variance risk premium with forecast error. It is reported as a market statistic, not as the result of selling options; its regime dependence is the subject of the companion paper Volatility Risk Premia in Crypto Options.

The link between implied volatility and price direction is unstable. The daily change in DVOL had a correlation of -0.33 with the same-day bitcoin price change over the full sample, but +0.33 in 2023 and +0.05 in 2024, against -0.58 in 2022 and -0.57 in 2026. In 2023 implied volatility rose with rallies, so a rule reading every rise as stress would have misread the year. DVOL's correlation with the VIX was 0.34 in levels and 0.27 in daily changes.

4.3 Funding marks the leverage cycle. Table 2 summarises funding by venue. Binance BTCUSDT, the longest USDT-margined series, averaged 11.5% annualised with a median of 8.1%, and was negative on 12.2% of days, with extremes of -161.3% (13 March 2020) and +172.3% (9 February 2021). Deribit's coin-margined perpetuals show lower medians and more negative days. Formulas, intervals, margining and sample periods differ, so levels are not directly comparable.

Funding has changed character. Binance BTCUSDT funding averaged 5.1% in 2025 and 3.0% in 2026, when it was negative on 24.2% of days, the highest share of any year in the sample. On Binance, funding equals the average premium plus the gap to a fixed interest term of 0.01% per eight hours, with the gap clamped at 0.05% either way (He and co-authors). A print of exactly 0.0100% therefore means the premium sat inside the clamp band. Such prints were between 30.8% and 50.5% of bitcoin prints in each year from 2020 to 2024, but 17.2% in 2025 and 6.7% in 2026. A funding-sign rule calibrated on earlier years would now see more negative readings, possibly for structural rather than stress-related reasons. The companion paper The Perpetual Futures Basis: Microstructure and Capture covers the mechanics.

Venues agree on direction more than level. From 26 March 2020 (2,405 days), daily bitcoin funding correlated at 0.80 between Binance and Bybit and 0.54 between Bybit and Deribit, rising to 0.91 and 0.74 on 7-day averages. Over the last 97 days, the only window with all five venues, daily correlations ranged from 0.26 (Binance and Kraken Futures) to 0.67 (Binance and Bybit). This argues for building a funding signal from venue-normalised inputs rather than from one venue's sign.

High funding has preceded higher volatility, and negative funding has followed stress (Table 3). In the top quintile of 7-day funding, above 13.4% annualised, RV30 over the next 30 days averaged 76.8, against 48.9 to 53.2 in the middle quintiles. In that quintile, 27.9% of days were followed within 30 days by a daily bitcoin fall of more than 10%, against 14.6% of all days. In the bottom quintile, current volatility was high (65.6), later volatility lower (51.0), and only 5.1% of days were followed by such a fall. This is consistent with the finding of Schmeling, Schrimpf and Todorov, in a BIS working paper on the futures basis, that high crypto carry predicts crashes.

The shares rest on few events. Windows overlap, so the effective sample is much smaller than the day count. The 27.9% comes from seven distinct falls, all in 2020 and 2021; top-quintile days fell in 2019 to 2021, 2023 and 2024, but not in 2022, 2025 or 2026. The bottom quintile's 5.1% comes from five falls, three of them on 9 May, 13 June and 9 November 2022. The quintile breakpoints use the whole sample. With breakpoints computed only from data available on each day, from September 2020, 22.7% of the 203 top-quintile days were followed by such a fall, against 13.9% of all days in the same window.

4.4 Correlation is a regime variable. Over 2,511 US trading days to 21 October 2026, bitcoin's daily correlation with the S&P 500 was 0.28. The rolling 90-trading-day correlation ranged from -0.34 (9 August 2019) to 0.62 (11 February 2026) and was 0.38 on 21 October 2026. Our replication of the IMF's windows gives 0.016 for 2017 to 2019 and 0.366 for 2020 to 2021, against its 0.01 and 0.36. Weekly correlations were lower than daily ones in most years (0.20 over the sample), so asynchronous closes do not appear to depress the daily figures.

Correlation rises with equity stress, mostly because volatility rises (Table 4). It rose from 0.07 on days with the VIX below 15 to 0.53 on days with the VIX at 30 or above. Equity variance was 22.7 times as high on those stressed days as on days with the VIX below 20, and after the Forbes-Rigobon adjustment the stressed correlation is 0.13, against 0.10 on calm days. In Forbes and Rigobon's terms, this is interdependence more than contagion. The adjustment explains the rise; it does not remove it, and an allocator still experiences the higher measured correlation.

Joint sell-offs co-move more than joint rallies. In the 10% tails, the bitcoin-S&P 500 correlation was 0.53 on joint down days against 0.39 on joint up days; in the 30% tails, 0.49 against 0.19. A bivariate normal distribution with the same overall correlation would give joint-tail correlations of only about 0.07 in the 10% tails and 0.09 in the 30% tails. Both tails co-move more than a normal model implies, and the down tail far more, in line with Longin and Solnik's finding for equity markets. On the 87 days the S&P 500 fell by more than 2%, bitcoin fell on 70.1% of them.

Where stress starts matters. In the two-state hidden Markov model described in Section 4.6, which sees only bitcoin data, the bitcoin-S&P 500 correlation was 0.24 in the calm state and 0.30 in the turbulent state, where bitcoin's variance was about ten times as high. Adjusted with bitcoin as the source market, the turbulent figure falls to 0.10. Crypto-led stress barely moves measured equity correlation; equity-led stress moves it much more.

Within crypto, diversification is thin. Bitcoin's daily correlation with ether was 0.72 from June 2016 and 0.82 or higher in most years since 2018. The rolling 30-day correlation stood at 0.93 on 25 October 2026, and in the grid below it averaged 0.90 or more in every negative-funding state.

4.5 A rule-based grid: volatility terciles crossed with funding sign. Positive funding dominated every volatility tercile, and the three positive-funding states covered 90.1% of days (Table 5). Low volatility with positive funding had the longest spells, averaging 20.9 days and lasting up to 160. Negative-funding states were rare and short, with mean spells of 4.8 to 6.3 days. The six-state label changed 27.1 times a year.

Volatility states persist for weeks, negative funding for days. On volatility alone, mean spells were 23.5 days for low, 13.7 for mid and 32.0 for high, with daily staying probabilities of 0.958, 0.927 and 0.969; low and high never switched directly in one day. Negative-funding spells averaged 7.4 days (longest 30), against 64.5 days for positive. On unsmoothed daily funding, negative spells averaged 2.3 days (median 1, longest 16). The 30-day and 7-day windows behind the labels lengthen the measured spells. Persistence is partial: 30 days after a low-volatility day, 53% of days were still low and 16% high, against a third each by construction; from the high state, 51% were still high and 13% low.

The rarest state is the most extreme (Table 6). High volatility with negative funding covered 4.1% of days, with RV30 averaging 107.2, ether's RV30 135.3 and the bitcoin-ether correlation 0.92. The 107.2 includes March 2020, before DVOL existed. On the 69 of those days with DVOL, from June 2021, RV30 averaged 79.6 and DVOL 78.2. On volatility alone, DVOL sat 10.1 points above current RV30 in the low tercile and 3.5 in the high, and the S&P 500 correlation rose from 0.32 to 0.43.

Hindsight and real time disagree. Real-time labels, from expanding-window terciles since 2015, match labels from fixed cut-offs over the full 2015-2026 history on 74.4% of days, and labels from the grid's fixed 2019-2026 cut-offs on only 61.0%. The real-time cut-offs were 53.6 and 81.7 volatility points on 1 January 2020 and 45.7 and 67.3 on 25 October 2026. With the grid's fixed cut-offs, the high state took 84.4% of 2021 but 6.3% of 2025. Any published regime chart should say whether its cut-offs use hindsight.

4.6 Hidden Markov models. The Bayesian information criterion is lowest with four states: 20,448, against 20,475 with three, 20,659 with two and 21,998 with one. Extra states partly absorb fat tails rather than describe persistent regimes, and formal tests for the number of regimes are non-standard, so Table 7 reports two and three states.

The two-state model's states are short, with expected durations of 9.8 and 6.1 days and 197 smoothed turbulent spells with a median of 3 days. On daily data it acts partly as a large-move detector. The three-state model is more informative. Its calm and normal states alternate within days and together describe ordinary fat-tailed days. Its turbulent state, at 116.6% volatility, lasts 15.3 days on average and never moves directly to calm (estimated daily probability 0.000). On the smoothed path it has 42 spells, with a median of 9 days and a longest of 180. As in Ang and Timmermann's estimates, the states are defined by volatility, which differs about sixfold between the calm and turbulent states; this paper does not report or test state means.

Turbulence has become rarer. The three-state turbulent share was 54.0% of days in 2017 and 42.2% in 2021, but 2.5% in 2023 and 3.0% in 2026. In the two-state turbulent state, Binance bitcoin funding had a median of 11.0% annualised against 7.3% in the calm state, and was negative more often (15.8% of days against 10.6%), consistent with leverage that builds and then unwinds. S&P 500 volatility on the same days was 22.5% against 14.4%, annualised over 252 trading days.

Hindsight flatters, and parameters drift. With full-sample parameters, the filtered two-state path agrees with the smoothed path on 88.4% of days but switches 69.7 times a year against 34.9; for three states, 120.1 against 76.8. With parameters refitted at each year-end, so that nothing after the day is used, the two-state path since 2018 agrees with the smoothed path on 86.1% of days and switches 74.9 times a year against 36.4; the three-state path switches 97.7 times against 80.5. Real-time paths switch up to about twice as often as the hindsight view, in line with Ang and Timmermann's warning that real-time inference raises false alarms. In the year-end refits, the two-state turbulent volatility stayed between 101.0% and 106.7%, but the calm state's daily persistence fell from 0.94 (fit to end-2017) to between 0.85 and 0.88 (fits from end-2020), and the three-state turbulent persistence ranged from 0.71 to 0.93.

4.7 Detection: what each signal knew on the day. Since 2018 the hindsight reference has 29 turbulent spells covering 17.2% of days, with a median length of 9 days (Table 8). The first began on 30 October 2017 and is counted from 1 January 2018.

Against this reference, fast signals catch everything and raise many false alarms; slow signals are quiet and miss. Seven-day realised volatility and the real-time three-state model detected all 29 spells with a median lag of one day, but 47 of 100 and 61 of 138 of their signal spells were false alarms. The two-state model was faster, but 262 of its 331 signal spells were false alarms. Thirty-day realised volatility raised 5 false alarms but detected 15 spells, with a median lag of eight days. A DVOL level threshold detected 4 of 10, partly because DVOL's level drifted down, although DVOL rose on the day of each event in Section 4.8 where it was available. Over DVOL's window from March 2022, the same 10 spells were detected by RV7 (10), the three-state model (10), EWMA (9) and RV30 (5).

A second reference, smoothed two-state turbulent spells of at least 10 days (29 since 2018), is broader. The two-state turbulent state covers about a third of days, so few signal spells fall outside it. Against this reference, RV7 detected 28 of 29 spells with a median lag of 3.5 days and 3 false-alarm spells, RV30 detected 19 with a median lag of 3 days and 1 false alarm, and EWMA detected 21 with a median lag of 5 days and none. The real-time two-state model detected all 29 with a median lag of 0 days but raised 101 false-alarm spells. The size of the trade-off therefore depends on what is counted as a regime. Both references use future data, and 29 spells is a small sample.

4.8 Event study: seven stress dates. Tables 9 and 10 show what public signals read on seven dates, each tied to a source. The COVID-19 sell-off of 12 March 2020 produced the largest daily bitcoin fall in the sample, as funding turned substantially negative on most exchanges (He and co-authors). The IMF records exchange outages on 19 May 2021, when liquidations of leveraged positions peaked. The Federal Reserve records that a run on TerraUSD in May 2022 led to its complete collapse within days, and the SEC's complaint against Celsius dates the halt of its platform to 12 June 2022. He and co-authors place the FTX insolvency in November 2022, when funding turned significantly negative on all solvent exchanges. BIS Bulletin 90 dates the August 2024 peak to 5 August, when the TOPIX lost 12%. FTI Consulting reports more than $19 billion of leveraged positions liquidated in roughly a day on 10 October 2025.

Leverage unwinds and credit failures look different. In the ten days before 12 March 2020 and 19 May 2021 the 7-day funding average reached 32.5% and 57.0% annualised, both in the top quintile of Table 3. Before TerraUSD, Celsius and FTX it peaked at between 5.8% and 7.5%, in the third quintile. Daily funding fell to -23.3%, -6.3% and -56.7% annualised within three days of those dates; the 7-day average turned negative within days of Celsius and FTX but stayed positive after TerraUSD. Before the liquidations of 10 October 2025 the 7-day average peaked at 9.3%, in the fourth quintile, in a year of lower funding (Section 4.3). Funding gauges crowded leverage, not counterparty risk, and thresholds set on 2020 and 2021 levels sat above the 2025 reading.

Calm readings preceded several shocks. Real-time RV30 rated bitcoin low-volatility on 8 November 2022 and 10 October 2025, and never reached the top tercile within 30 days of 5 August 2024 or 10 October 2025. The fast signals moved on the day: RV7 jumped from 39 to 85 and from 28 to 60, and DVOL rose from 59.5 to 76.7 and from 39.7 to 44.1. On 10 October 2025, RV7 reached its real-time top tercile two days later. The real-time two-state model labelled all seven dates turbulent. The three-state model did not label 10 October 2025 turbulent, in real time or in hindsight: a one-day shock from a low-volatility base did not start a persistent spell. BIS Bulletin 90 places the risk-taking before August 2024 amid unusually low volatility. A calm label is not a safety signal.

Not all stress starts in crypto. On 12 March 2020 and 5 August 2024 the S&P 500 fell 9.5% and 3.0%, and the VIX closed at 75.5 and 38.6. In 2020 it went on to close at 82.7 on 16 March, its highest close since the series began in 1990. Bitcoin's equity correlation over the 90 US trading days from each date, against the 90 before, rose from 0.23 to 0.55 and from 0.28 to 0.53. FTX was specific to crypto: the S&P 500 rose 0.6% on 8 November 2022, and the same correlation fell from 0.52 to 0.40. A framework that watches only crypto data sees equity-led stress late; one that watches only cross-asset data misses crypto-specific failures.

5. Implications for allocators

The findings point to a general framework for regime-conditioned allocation. It is general education for professional investors, not a recommendation. It is not a description of Hedgehog's model; Hedgehog's published description is summarised at the end of this section.

Regimes as risk states, not return forecasts. Regimes are identified mainly by volatility. The natural use of a regime estimate is to set how much exposure a strategy may carry in current conditions, not to predict direction. Correlation belongs alongside volatility, because diversification within crypto narrows in stress and equity correlation rises when stress starts in equities.

Refresh speed. Bitcoin's turbulent state lasts about two weeks on average, and negative 7-day funding spells about a week. A monthly regime label cannot follow states that turn over in days and weeks. A daily estimate keeps closer pace, but Section 4.7 shows that even daily signals lag or raise false alarms. Moves inside a single day, such as the liquidations of 10 October 2025, are faster than any daily estimate. They fall to risk limits that respond to prices directly, and no limit or update removes the risk of such a move (Section 6).

Moving thresholds and a real-time record. Fixed cut-offs from the 2019-2026 sample put 84.4% of 2021 and 6.3% of 2025 in the high-volatility state. The results favour states defined relative to a moving window, parameters refitted through time and a record of what the estimate said each day. Hedgehog's EVAR note states the test: "Judge any regime signal by what it knew on the day."

Fast and slow signals. Against the three-state reference no detector was both fast and quiet, and on the broader two-state reference the fastest signal still raised the most false alarms. One design uses fast signals to tighten risk limits and slower confirmation to relax them. It accepts false alarms where their consequence is smallest: a false alarm leaves a strategy smaller for a few days, while a missed spell leaves it at full size through the stress.

Funding as a leverage gauge. High funding has preceded higher volatility; negative funding has followed stress, with negative 7-day funding spells lasting about a week. For strategies whose economics depend on funding, its sign and persistence are direct regime inputs. Funding levels are not comparable across venues without normalisation: Deribit bitcoin funding was negative on about a quarter of days, and the share of Binance prints at the interest term has fallen sharply.

Venue and counterparty risk outside the regime estimate. The 2022 failures arrived with ordinary funding and, for FTX, from a low-volatility reading. Price-based signals cannot see a venue failing before prices move. Per-venue and per-counterparty limits are a separate control, beside the regime estimate rather than inside it.

Implied volatility as a level and jump signal. DVOL carries information about next-month realised volatility beyond current RV30, and it rose on the day in every event where it was available. Its link to price direction changed sign in 2023, so it is not a directional fear gauge.

Correlation in stress. In this sample, bitcoin's correlation with US equities rose when stress started in equities, and the bitcoin-ether correlation averaged 0.90 or more in every negative-funding state. A stress test that keeps calm-period correlations would understate co-movement in both cases.

How Hedgehog describes its own process. Hedgehog's published materials state the following. The regime estimate is refreshed every day using cross-asset signals, realised volatility and spread behaviour, and delivered to each client's Hedgehog AI; risk is monitored in real time. EVAR conditions the loss distribution on the current regime, rising when the regime shifts towards high volatility and falling when it stabilises. EVAR is calculated for each strategy and for the book as a whole. The platform page says a strategy's position limit tightens when its own EVAR rises, and other strategies are unaffected unless their own EVAR rises. The EVAR note says each strategy's EVAR-based limit tightens automatically when the book's EVAR rises because the regime has shifted, and widens again when the regime calms. Each strategy is refitted to the current regime rather than calibrated once on a fixed history. EVAR for the volatility book uses a separate regime signal. For basis positions, the position reduces, or closes, when signals point towards a negative-funding environment. The strategy library describes basis sizing as larger when funding is persistent, and mean reversion and trend following as sized down in trending and ranging conditions respectively. Size has two limits, the client's allocation and the most that strategy can take, and the smaller wins. Clients choose which strategies run and at what size.

This paper adds nothing to that description. How regime-conditioned limits combine across a book is the subject of Multi-Strategy Portfolio Construction Under EVAR Constraints.

6. Risks and limitations

• Illustrative classifiers. Tercile cut-offs, window lengths, the 7-day funding average and the number of hidden Markov states are choices, and results shift with them. Neither classifier is Hedgehog's model.
• Hindsight reference. The detection reference uses future data by construction and comes from the same model family as the hidden Markov detectors, which favours them. Only the real-time variants show what a model knew on the day, and 29 spells is a small sample.
• Model form. The hidden Markov models are Gaussian, with constant transition probabilities within each fit, and see only bitcoin prices.
• Data coverage. Spot prices come from one venue, Coinbase, checked against Kraken for 720 days. DVOL starts in March 2021. Binance is the only long USDT-margined funding history in the grid; OKX's API returns three months of history and Kraken Futures' returned about one year. Funding histories come only from venues operating in 2026. FTX, then the fourth-largest crypto exchange according to He and co-authors, is absent, so cross-venue statistics for 2021 and 2022 describe surviving venues only. Venue funding formulas differ, and this paper does not describe Deribit's.
• Overlapping windows. Forward 30-day volatility and 90-trading-day correlations overstate the effective sample size. The 30-day and 7-day windows also lengthen measured spells of the RV30 terciles and the funding sign.
• Timing. Bitcoin is sampled three to four hours after the US close, and event dates are UTC days that may not match the intraday timing of each episode.
• Structural change. Relationships measured from 2015 to 2026 may not hold in future regimes, and the next stress may come from a source none of these signals observes.

A regime estimate does not predict direction and cannot remove the risk of a move faster than any update. Hedgehog's EVAR note says the same of EVAR: a single session can move beyond any reasonable estimate.

7. Conclusion

Crypto regimes are real, short and mostly about volatility. A three-state model of bitcoin's daily changes finds a persistent turbulent state at 116.6% annualised volatility lasting about two weeks on average, beside calm and normal states that alternate within days. Correlation and funding add information volatility does not carry: bitcoin's equity link rises when stress starts in equities, and high funding marks crowded leverage before it unwinds.

The difficulty is recognising regimes on the day, not describing them afterwards. Bitcoin's realised volatility has roughly halved since 2021, and the level that counts as high has moved with it. Against the stricter reference, fast detectors catch every episode at the cost of many false alarms; slow ones miss or arrive late. The 2022 failures came with ordinary funding, and two of the sharpest recent shocks came from low-volatility readings.

For an allocator, the results favour regime estimates used to scale risk rather than to forecast direction. The evidence here points to estimates that draw on several signal families, are re-anchored and refitted through time, are judged by what they knew on the day, and sit beside separate venue and counterparty limits. This paper does not test Hedgehog's process, and nothing in it measures how any strategy has performed or will perform.

About the data

Data: Coinbase Exchange daily candles for BTC-USD (20 July 2015 to 25 October 2026) and ETH-USD (1 June 2016 to 25 October 2026), cross-checked against Kraken daily closes for the last 720 days, the history Kraken's OHLC endpoint returns; Deribit DVOL for BTC and ETH (24 March 2021 to 25 October 2026); perpetual funding rates from the public APIs of Binance USD-M (BTCUSDT from 11 September 2019, ETHUSDT from 28 November 2019), Bybit (BTCUSDT from 26 March 2020, ETHUSDT from 22 October 2020), Deribit (BTC and ETH perpetuals from 2 May 2019), OKX (from 21 July 2026) and Kraken Futures (from 16 October 2025); and S&P 500, Nasdaq Composite and VIX daily closes from FRED (S&P 500 to 21 October 2026, Nasdaq and VIX to 23 October 2026). All series are public and were downloaded without keys. Method: daily log changes at the 00:00 UTC close, with single-day and event moves quoted as simple price changes; rolling realised volatility (RV7, RV30) with a zero-mean convention and 365-day annualisation; calendar-year and full-sample volatility as the annualised standard deviation of daily log changes (365 days for crypto, 252 trading days for equities); EWMA volatility with decay 0.94; funding prints summed by the UTC day in which each accrual interval ends, with Kraken Futures timestamps read as the start of each hourly period, as Kraken documents, and annualised by 365; Pearson correlations of bitcoin with US equities on US trading days and of bitcoin with ether on all calendar days, with Forbes-Rigobon adjustments where stated; GARCH(1,1) by Gaussian quasi-maximum likelihood and Student-t maximum likelihood; Gaussian hidden Markov models with one to four states fitted by expectation-maximisation with 12 seeded random starts (8 for the year-end refits), with real-time variants refitted at each year-end; real-time volatility states from expanding-window terciles with at least 365 days of history; and a bivariate normal benchmark for joint-tail correlations from 2 million seeded draws. Data through 25 October 2026 unless stated. Every figure is a market statistic computed from these data or cited from a named source; none is the result of a strategy, portfolio or backtest. S&P 500 and Nasdaq data are used only to compute derived statistics. The download script, analysis script, raw responses and computed results are retained by Hedgehog Capital Research so that every figure can be reproduced.