Ransomware payments at record low

Despite rising attacks

Despite claims of record attacks, ransomware victims are paying off cybercriminals at the lowest ever rate.

Claimed attacks rose 50% in 2025, but cryptocurrency payments made using blockchain (the most common way criminals demand to be paid) fell to 28.8%, according to a report by blockchain analysis firm Chainalysis.

That follows a steady decline from 78.9% in 2022, 72.2% in 2023 and is more than double the 63.8% recorded in 2024.

Despite the currently reported fall in payment rates, the median average payment rose significantly: up 368% to nearly $60,000.

The overall effect of falling payment rates but a rise in amount paid has been a minimal net change in aggregate ransomware revenue: down 8% to $820 million in 2025, from an estimated $892 million in 2024.

However, the 2024 figure was revised from an initial estimate of $813 million at this time last year, and Chainlysis says the 2025 total may eventually rise to more than $900 million, which would be a 0.89% increase.

The divergence between more claimed attacks (according to eCrime.ch) but fewer payments reflects a variety of factors shaping the ransom economy, which include improved incident response; increased regulatory scrutiny; and effective international action against criminals.

Observers have also seen “marked fragmentation of major ransomware-as-a-service (RaaS) operations” and “decreasing centralisation in the ransomware market,” leading to a proliferation of as many as 85 active groups.

The spread of fewer, less centralised attackers means fewer large, attention-grabbing attacks and more volume focused on SMEs, though some massive attacks – like those hitting Marks & Spencer and Jaguar Land Rover - still made it through.

“The assumption is simple - smaller victims pay faster,” says Corsin Carmichael, founder of eCrime.ch. “However, Chainalysis’ data shows payments trending downward despite an all-time high in public claims. That divergence is important. It suggests attackers are working harder for diminishing returns.”

The massive increase in average payment amounts is attributed to victims hoping a larger payment will convince criminals to delete data, not sell or trade it to other threat actors.

Although ransomware payments continued the downward trend in 2025, Chainalysis says the scale, sophistication and real-world impact of attacks continued to grow.

The report authors believe ransomware operators are going through a period of adaptation, rather than retreat, with evolving tactics to extract more value from a shrinking pool of victims.