RANSOMWARE actors are extorting bigger payments from a smaller number of victims, as the number of those victims surges but overall revenues fall, according to Chainalysis. The blockchain analytics firm revealed in its analysis that the overall figure tumbled 8% year-on-year to $820m in 2025, with payments set to approach or exceed $900m as new events are attributed in the coming months.
Victim numbers surged by 50% YoY in 2025, making it the most active year on record, while payment rates plummeted from 63% in 2024 to just 29% last year. The median payment increased 368%, from $12,738 in 2024 to $59,556 in 2025, the report notes, and four trends were identified, including fewer victims paying due to better incident response and increased regulatory scrutiny, and a marked fragmentation of RaaS operations.
The US was the most heavily targeted country last year, followed by the UK and other parts of Europe, with infrastructure such as bulletproof hosting and proxy networks now used by both cybercrime groups and state-aligned actors.