Ransomware Attacks Soar, Revenue Plummets – What?

by

In a stunning twist of fate, the universe has decided that ransomware payments should decrease by 8% in 2025, which is the second year of this bizarre trend.

But don’t worry, the number of attacks has increased by 50%, proving that even in the digital age, chaos is always on the rise. It’s like a cosmic game of whack-a-mole, but the mole is a hacker with a grudge.

Ransomware Payments Reach $820 Million in 2025

In the ransomware chapter of its 2026 Crypto Crime Report, Chainalysis disclosed that ransomware actors collected more than $820 million in on-chain payments in 2025. The figure represents an 8% year-over-year decline from the firm’s revised 2024 estimate of $892 million. A decline so sharp, it could make a philosopher weep.

However, the 2025 total could still rise. Chainalysis noted that the final figure may approach or surpass $900 million, mirroring last year’s adjustment when the initial 2024 estimate of $813 million was later revised upward. Because nothing says “I’m a data analyst” like changing your mind after the fact.

Follow us on X to get the latest news as it happens

Even as total payments showed relative stability, ransomware activity intensified sharply. Data from eCrime.ch indicates that claimed ransomware victims increased 50% year over year in 2025, making it the most active year on record. Despite the surge in attacks, the share of ransoms paid fell to 28%, a record low. Because who needs money when you can just pretend to be a victim?

Chainalysis cited several factors behind the divergence. Improved incident response and tighter regulatory oversight have helped reduce the frequency of payouts. Or maybe the hackers are just too busy binge-watching cat videos to bother.

Furthermore, international enforcement efforts against these actors and laundering networks have constrained some revenue flows. Because nothing says “we’re serious” like chasing digital ghosts with a net made of bureaucracy.

“In some cases, the introduction of strains like VolkLocker, notable for a cryptographic weakness that allowed free decryption in some cases, illustrates how technical vetting by defenders can occasionally disrupt a ransomware strain,” the report read.

Bitcoin Remains Top Choice as Ransomware Median Payments Soar

While total payments stagnated, median ransom sizes rose sharply in 2025. The median payment surged 368%, climbing from $12,738 in 2024 to $59,556 in 2025. Because nothing says “I’m a big-time hacker” like demanding nearly $60k in a cryptocurrency that’s basically a digital version of a paper bag.

Jacqueline Koven, Head of Cyber Threat Intelligence at Chainalysis, told BeInCrypto that the median payment is likely driven up by a small number of relatively high outlier payments rather than a return to big-game hunting ransomware tactics that dominated in the past. Or maybe the hackers are just getting desperate and asking for more money, like a toddler at a buffet.

“Ransomware actors are opportunistic, and we continue to see victimization of organizations of all sizes,” she said.

Koven also revealed that Bitcoin (BTC) remains the financial rail of choice for ransomware actors. She explained that despite its transparency, which poses a risk to bad actors, they prefer BTC because it is cross-border, instantaneous, liquid, and easy to use. Because nothing says “I’m a criminal” like using a currency that’s as easy to trace as a trail of glitter.

“Bitcoin is still preferred for ransomware payments,” she added.

$14 Million Paid to Initial Access Brokers as Ransomware Pipeline Expands

The report also explained that ransomware operations are supported by a wider cybercriminal ecosystem that includes Initial Access Brokers and other specialized service providers. These brokers facilitate access to compromised networks, allowing affiliates to deploy ransomware with relative ease. Because even hackers need a little help from their friends.

Chainalysis estimates that Initial Access Brokers received at least $14 million in on-chain payments in 2025, a figure largely unchanged from the previous year. While small compared to overall ransomware revenues, the payments highlight the “critical enabling function.” Because nothing says “I’m essential” like selling access to someone else’s computer.

“It is important to note that not all IAB payments are made by ransomware operators. IABs certainly trade and buy accesses among themselves and some malicious actors have TTPs and objectives other than ransomware. Another important caveat is that not all ransomware incidents can be traced to initial access brokers – there are a number of different ways to gain access to victim networks. With those caveats in mind, we can draw a connection between criminal investments and the ransomware attacks that follow,” Chainalysis said.

The report added that IAB activity can serve as a leading indicator. According to on-chain analysis, surges in IAB inflows tend to precede increases in ransomware payouts and victim leaks by roughly 30 days. Because even the digital underworld needs a little warning before chaos ensues.

“IAB payments are a powerful glimpse into the ransomware ecosystem because even as ransomware groups have fragmented and rebranded, as we note in our report, dependencies on IABs remain constant. In that way, IAB and even infrastructure payments can signal attack preparation,” Koven mentioned to BeInCrypto.

Chainalysis stressed the ransomware story of 2025 cannot be understood through revenue figures alone. While total on-chain payments declined modestly, the scale, sophistication, and strategic impact of attacks continued to expand. Organizations of all sizes, from global automakers to regional healthcare providers, faced extortion that disrupted operations, eroded trust, and generated systemic losses far exceeding recorded ransom payments. Because nothing says “I’m a victim of cybercrime” like losing your data and your dignity in one fell swoop.

Read More

2026-02-26 16:37