Ransomware extortion drops 35% in 2024 amid crypto exchange crackdowns and increasing refusal to pay: Chainalysis

Quick Take
- Ransomware payments fell 35% to $813 million in 2024 from $1.25 billion the year before, according to Chainalysis’ 2025 crypto crime report.
- Sanctions on dozens of Russian centralized exchanges and a decline in onchain payments made by victims helped reduce extortion figures.


Ransomware payments dropped 35% to $813 million in 2024 — down 35% from the record-breaking $1.25 billion extorted by cybercriminals the year before, according to blockchain analytics firm Chainalysis.
Per Chainalysis’ 2025 crypto crime report, the attackers had looked set for another record payday in 2024, with the value stolen in the first half of the year up 2.4% on 2023, including $75 million paid by an undisclosed victim to the Dark Angels group. However, a sharp pullback in ransomware payments in the latter half of 2024 meant the value extorted dropped overall.
While centralized exchanges remained a preferred means for the cybercriminals to convert their crypto gains into fiat currencies, sanctions against the Russia-based exchange Cryptex and the German Federal Criminal Police’s seizure of 47 Russian language non-KYC crypto exchanges last year impacted the ability of ransomware actors to launder their illicit earnings, Chainalysis said.
“Ransomware operators, a primarily financially motivated group, are abstaining from cashing out more than ever,” Chainalysis Head of Cyber Threat Intelligence Jacqueline Burns Koven said. “This potentially indicates a fear of being traced, identified, and prosecuted by law enforcement agencies, made possible with the help of crypto investigation tools.”
More victims refuse to pay
Another positive trend the blockchain analytics firm highlighted is a widening gap between the payouts demanded by attackers and the amounts sent onchain by victims. Despite the number of ransomware events increasing, there was a 53% difference between demands and sends in the second half of 2024, suggesting that while more victims were targeted, fewer paid, Chainlysis said. Victims who did pay attackers typically ended up sending between $150,000 and $250,000 in ransom, regardless of the attackers' initial demands, the firm added.
“For years now, the cybersecurity landscape seemed hurtling towards a so-called ransomware apocalypse, so this sharp decline, to levels even lower than those in 2020 and 2021 speaks to the effectiveness of law enforcement actions, improved international collaboration, and a growing refusal by victims to cave into attackers demands,” Koven said.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2024 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.