Ransomware extortion drops 35% in 2024 amid crypto exchange crackdowns and increasing refusal to pay: Chainalysis

Quick Take

  • Ransomware payments fell 35% to $813 million in 2024 from $1.25 billion the year before, according to Chainalysis’ 2025 crypto crime report.
  • Sanctions on dozens of Russian centralized exchanges and a decline in onchain payments made by victims helped reduce extortion figures.

Ransomware payments dropped 35% to $813 million in 2024 — down 35% from the record-breaking $1.25 billion extorted by cybercriminals the year before, according to blockchain analytics firm Chainalysis.

Per Chainalysis’ 2025 crypto crime report, the attackers had looked set for another record payday in 2024, with the value stolen in the first half of the year up 2.4% on 2023, including $75 million paid by an undisclosed victim to the Dark Angels group. However, a sharp pullback in ransomware payments in the latter half of 2024 meant the value extorted dropped overall.

While centralized exchanges remained a preferred means for the cybercriminals to convert their crypto gains into fiat currencies, sanctions against the Russia-based exchange Cryptex and the German Federal Criminal Police’s seizure of 47 Russian language non-KYC crypto exchanges last year impacted the ability of ransomware actors to launder their illicit earnings, Chainalysis said.

“Ransomware operators, a primarily financially motivated group, are abstaining from cashing out more than ever,” Chainalysis Head of Cyber Threat Intelligence Jacqueline Burns Koven said. “This potentially indicates a fear of being traced, identified, and prosecuted by law enforcement agencies, made possible with the help of crypto investigation tools.” 

More victims refuse to pay

Another positive trend the blockchain analytics firm highlighted is a widening gap between the payouts demanded by attackers and the amounts sent onchain by victims. Despite the number of ransomware events increasing, there was a 53% difference between demands and sends in the second half of 2024, suggesting that while more victims were targeted, fewer paid, Chainlysis said. Victims who did pay attackers typically ended up sending between $150,000 and $250,000 in ransom, regardless of the attackers' initial demands, the firm added.

“For years now, the cybersecurity landscape seemed hurtling towards a so-called ransomware apocalypse, so this sharp decline, to levels even lower than those in 2020 and 2021 speaks to the effectiveness of law enforcement actions, improved international collaboration, and a growing refusal by victims to cave into attackers demands,” Koven said.


Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.

© 2024 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

About Author

James Hunt is a reporter at The Block and writer of The Daily newsletter, keeping you up to speed on the latest crypto news every weekday. Prior to joining The Block in 2022, James spent four years as a freelance writer in the industry, contributing to both publications and crypto project content. James’ coverage spans everything from Bitcoin and Ethereum to Layer 2 scaling solutions, avant-garde DeFi protocols, evolving DAO governance structures, trending NFTs and memecoins, regulatory landscapes, crypto company deals and the latest market updates. You can get in touch with James on Telegram or 𝕏 via @humanjets or email him at [email protected].

Editor

To contact the editor of this story:
Adam James at
[email protected]

WHO WE ARE

The Block is a news provider that strives to be the first and final word on digital assets news, research, and data.

+ Follow us on Google News
Connect with the block on