Loading story…
Chainalysis’ 2026 Crypto Crime Report assessed the 2025 ransomware economy and found that on-chain ransomware payments fell ~8% year-over-year to about $820M, even as claimed attacks increased ~50%. The report also observed a sharp rise in the median ransom payment (to roughly $60K, up several-fold from 2024), suggesting attackers are concentrating on larger, higher-value victims even as fewer victims pay overall. Chainalysis highlighted Initial Access Broker (IAB) activity as a potential leading indicator, noting that spikes in IAB-related inflows often precede increases in ransomware payments and victim leak activity by ~30 days, and it described increasing convergence in the “enablement” layer (e.g., shared use of bulletproof hosting and residential proxy services) across financially motivated and state-linked actors.
Recorded Future News’ The Record reported additional metrics from the same Chainalysis analysis, including that the victim payment rate dropped to a record low (~28%) and that the $820M figure may rise toward ~$900M as attribution improves (mirroring how 2024 totals increased after initial reporting). The article attributed the divergence between rising incident volume and falling payments to improved incident response, increased regulatory scrutiny discouraging payments, and law-enforcement disruption that has fragmented major ransomware operations into smaller groups—some using poorly designed malware that can be addressed with decryptors. Other items provided (a UAE claim of thwarting a “terrorist” ransomware campaign and a CSIS incident timeline covering multiple unrelated 2025 events) are not part of the Chainalysis 2025 ransomware-payment findings and do not materially corroborate that specific report’s conclusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
By the first quarter of 2026, average prices for initial access had fallen markedly, according to Chainalysis. The trend was presented as evidence of a glut in the access-for-sale market supporting ransomware operations.
On February 26, 2026, Chainalysis published findings that ransomware was shifting rather than shrinking: more attacks, fewer payments, higher median demands, and growing dependence on access brokers and shared criminal infrastructure. The report also emphasized overlap between criminal and state-linked actors at the infrastructure layer.
During 2025, sanctions and coordinated law-enforcement actions, including Operation Endgame expansion, increasingly targeted loaders, hosting providers, proxy services, and other enabling infrastructure. The report said these actions raised attacker costs even if overall attack volume remained high.
Chainalysis found that the median ransom payment rose 368% from $12,738 in 2024 to about $59,556 in 2025. The increase suggested fewer but larger payments and a focus on bigger or more heavily pressured victims.
Chainalysis estimated that on-chain ransomware payments fell about 8% year over year to roughly $820 million in 2025, with the final attributed total potentially approaching or exceeding $900 million. The drop came even as attack volume and extortion pressure increased.
Despite the rise in attacks, only about 28% of victims paid ransomware demands in 2025, the lowest rate recorded by Chainalysis. The decline was attributed to improved incident response, regulatory pressure, reduced trust in criminals, and law-enforcement disruption.
Chainalysis said initial access brokers received roughly $14 million in on-chain payments in 2025. The report linked spikes in IAB inflows to later increases in ransomware payments and leak-site victim postings, often by about 30 days.
Chainalysis highlighted several high-impact 2025 incidents, including attacks affecting Jaguar Land Rover, Marks & Spencer, DaVita, and a key Whole Foods supplier. The report also referenced alleged Cl0p exploitation of an Oracle E-Business Suite zero-day during the year.
During 2025, claimed ransomware victim counts rose about 50% year over year to a record level, while the ecosystem splintered into as many as 85 active extortion groups. Reporting also described a shift toward more opportunistic and higher-volume attacks, including data-theft-only extortion in some cases.
Chainalysis reported that ransomware actors received about $892 million in 2024. The 2024 payment rate was cited as 64%, providing a comparison point for the much lower rate seen in 2025.
Chainalysis cited 2023 as a recent high-water mark for ransomware revenue, with on-chain payments totaling about $1.023 billion. This serves as the baseline for the subsequent multi-year decline in payments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcecsoonline.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcechainalysis.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by *BleepingComputer* puts the 2025 victim payment rate at **28%** (down from **62.8%** in 2024 and **78.9%** in 2022) while noting a roughly **50% year-over-year increase** in claimed attacks; on-chain ransomware payments for 2025 were estimated at **$820M** with the expectation the total could approach or exceed **$900M** as additional attributions are made. Despite lower overall payment participation, the **median ransom payment increased** sharply (reported as up **368%**, from **$12,738** in 2024 to **$59,556** in 2025), alongside greater ecosystem fragmentation (Chainalysis observed **85 active extortion groups**), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics. Separately, the UAE Cyber Security Council said it **thwarted** an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of **AI-enabled tooling** to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including **Medusa**’s claimed breach of **SimonMed Imaging** (reported ~**1.2M** patients affected; **$1M** demand to delete data) and a ransomware-enabled breach of UK defense contractor **Dodd Group** attributed to **Lynx** (reported ~**4TB** stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Jun 29, 2026
The US Treasury Department's Financial Crimes Enforcement Network (FinCEN) released a comprehensive report analyzing ransomware activity and payments from January 2022 to December 2024. The report revealed that over this three-year period, organizations reported 4,194 ransomware incidents and paid more than $2.1 billion in ransoms, nearly matching the $2.4 billion paid over the previous nine years. Ransomware payments peaked in 2023 at approximately $1.1 billion, followed by a significant decline to $734 million in 2024, a drop attributed to major law enforcement actions against prominent ransomware groups such as ALPHV/BlackCat and LockBit. Despite the decrease in payments, the number of reported incidents only slightly declined, indicating that while attacks remain frequent, fewer victims are paying ransoms. The report highlighted that the manufacturing, financial services, and healthcare sectors were the most targeted, with financial institutions suffering the largest monetary losses. The vast majority of ransom payments (about 97%) were made in Bitcoin, and most funds were laundered through unregulated cryptocurrency exchanges. The median ransom payment peaked at $174,000 in 2023 before dropping to $155,257 in 2024. The data underscores the evolving nature of the ransomware threat landscape and suggests that coordinated law enforcement efforts can have a measurable impact on the financial incentives driving ransomware operations.
Jun 29, 2026
Ransomware groups are experiencing a significant decline in payment rates, with only 23% of victims paying ransoms in Q3 2025, according to Coveware. This trend is attributed to organizations implementing stronger defenses, increased law enforcement pressure, and a growing understanding that paying to suppress stolen data offers little benefit. The average and median ransom payments have also dropped, with figures reaching $377,000 and $140,000, respectively. Ransomware-as-a-Service groups like Akira and Qilin are adapting by targeting different market segments, but even high-profile data exfiltration campaigns have yielded limited returns for attackers. As payments decrease, ransomware actors are shifting their tactics, focusing more on data exfiltration—now the primary objective in over 76% of observed attacks—and exploring new methods of initial access. Notably, there has been a rise in insider threats, with attackers bribing employees for credentials or remote access, and an evolution in helpdesk social engineering techniques. These changes reflect a more targeted and inventive approach by threat actors as they seek to overcome improved organizational defenses and maximize their chances of financial gain.
Jun 29, 2026