- Joined
- Jan 22, 2026
- Messages
- 101
- Reaction score
- 916
The era of uncontrolled digital transfers is coming to an end.
Chainalysis has documented a paradoxical pattern in the extortion market in 2025. The attackers claimed a record increase in the number of victims, but the total volume of ransoms in cryptocurrencies has hardly changed, and according to some estimates, it has even decreased.
According to the company, the total on-chain payments to extortionists (which actually took place inside the blockchain and are visible in the public transaction history) in 2025 amounted to about $ 820 million, which is about 8% less than the revised estimate for 2024 of $ 892 million. Chainalysis stipulates that the total for 2025 may grow as new episodes and transactions are attributed and approach $ 900 million. According to Chainalysis data for the first half of 2025, cryptocurrency remains the main settlement tool in the cybercrime economy.
Against the background of a relatively stable amount of ransoms, the number of reported attacks has increased dramatically. According to the data eCrime.ch The number of victims reported by ransomware groups through leak sites increased by 50% year-on-year. At the same time, the proportion of cases where victims paid could drop to 28%, which looks like at least for the entire time of observations.
Chainalysis attributes the gap between the surge in attacks and the stagnation of payments to several factors. Companies respond faster to incidents and more often refuse to pay due to regulatory pressure. International operations against gangs, infrastructure, and cashing chains are also triggered.
An additional role was played by the technical blunders of individual ransomware families, when encryption flaws made it possible to recover data without ransom. At the same time, the market has become more fragmented: instead of several dominant ransomware programs, many small groups have appeared, and some of the attacks have shifted towards small and medium-sized businesses, where cybercriminals rely on faster payments.
At the same time, the typical size of the buyout has increased significantly. The median payment amount, according to Chainalysis, jumped 368% from $12,738 in 2024 to $59,556 in 2025. The report's authors also describe a tightening of negotiating tactics. Some groups increased the pressure through contacts with the victims' employees and clients, while others relied on data theft and analyzed the stolen arrays in order to formulate more substantive threats. As the FBI's investigation into the BlackCat case shows, even cybersecurity experts sometimes side with extortionists for ransom.
Chainalysis has placed a special emphasis on the role of entry-level brokers who sell access to compromised networks. The company estimated their on-chain revenues in 2025 at at least $ 14 million, which is roughly the same as the previous year, but surges in the flow of funds to such intermediaries, according to observations, often anticipated an increase in ransom payments and publications about victims by about 30 days.
Another trend concerns infrastructure. According to Chainalysis, cybercriminals and state-linked actors are increasingly using the same services, including bulletproof hosting and resident proxy networks, to hide their activity. In 2025, law enforcement agencies and regulators increased pressure on this particular layer, targeting not only specific groups, but also suppliers of infrastructure and tools for downloading malicious code, which increases costs for the entire underground market.
Chainalysis has documented a paradoxical pattern in the extortion market in 2025. The attackers claimed a record increase in the number of victims, but the total volume of ransoms in cryptocurrencies has hardly changed, and according to some estimates, it has even decreased.
According to the company, the total on-chain payments to extortionists (which actually took place inside the blockchain and are visible in the public transaction history) in 2025 amounted to about $ 820 million, which is about 8% less than the revised estimate for 2024 of $ 892 million. Chainalysis stipulates that the total for 2025 may grow as new episodes and transactions are attributed and approach $ 900 million. According to Chainalysis data for the first half of 2025, cryptocurrency remains the main settlement tool in the cybercrime economy.
Against the background of a relatively stable amount of ransoms, the number of reported attacks has increased dramatically. According to the data eCrime.ch The number of victims reported by ransomware groups through leak sites increased by 50% year-on-year. At the same time, the proportion of cases where victims paid could drop to 28%, which looks like at least for the entire time of observations.
Chainalysis attributes the gap between the surge in attacks and the stagnation of payments to several factors. Companies respond faster to incidents and more often refuse to pay due to regulatory pressure. International operations against gangs, infrastructure, and cashing chains are also triggered.
An additional role was played by the technical blunders of individual ransomware families, when encryption flaws made it possible to recover data without ransom. At the same time, the market has become more fragmented: instead of several dominant ransomware programs, many small groups have appeared, and some of the attacks have shifted towards small and medium-sized businesses, where cybercriminals rely on faster payments.
At the same time, the typical size of the buyout has increased significantly. The median payment amount, according to Chainalysis, jumped 368% from $12,738 in 2024 to $59,556 in 2025. The report's authors also describe a tightening of negotiating tactics. Some groups increased the pressure through contacts with the victims' employees and clients, while others relied on data theft and analyzed the stolen arrays in order to formulate more substantive threats. As the FBI's investigation into the BlackCat case shows, even cybersecurity experts sometimes side with extortionists for ransom.
Chainalysis has placed a special emphasis on the role of entry-level brokers who sell access to compromised networks. The company estimated their on-chain revenues in 2025 at at least $ 14 million, which is roughly the same as the previous year, but surges in the flow of funds to such intermediaries, according to observations, often anticipated an increase in ransom payments and publications about victims by about 30 days.
Another trend concerns infrastructure. According to Chainalysis, cybercriminals and state-linked actors are increasingly using the same services, including bulletproof hosting and resident proxy networks, to hide their activity. In 2025, law enforcement agencies and regulators increased pressure on this particular layer, targeting not only specific groups, but also suppliers of infrastructure and tools for downloading malicious code, which increases costs for the entire underground market.
