Ransomware Revenue Declines for Second Year Despite 50% Surge in Attacks
Total on-chain ransomware payments fell 8% in 2025, the second annual decline, even as claimed attacks surged by 50%.Summary
According to Chainalysis's 2026 Crypto Crime Report, total on-chain ransomware payments decreased by about 8% in 2025, reaching over $820 million, marking the second consecutive annual decline from the revised 2024 figure of $892 million. This revenue drop occurred despite a sharp 50% year-over-year increase in claimed ransomware incidents, making 2025 the most active year on record, with the share of ransoms actually paid falling to a low of 28%. Chainalysis attributes the divergence between rising attacks and lower payouts to improved incident response, tighter regulation, and international enforcement efforts. Concurrently, the median ransom size soared by 368% to $59,556, though this is believed to be driven by a few high outlier payments rather than a return to large-scale extortion. Bitcoin remains the preferred payment method due to its cross-border utility. Furthermore, the report highlights the supporting ecosystem, noting that Initial Access Brokers received about $14 million, signaling attack preparation, as surges in their payments often precede ransomware incidents by about 30 days.
(Source：BeInCrypto)