FinCEN data shows $4.5B in ransomware payments, record spike in 2023

FinCEN data shows $4.5B in ransomware payments, marking a record spike in 2023, with FinCEN analysing trends from January 2022 to February 2025. According to FinCEN, there were 4,194 ransomware incidents in the period and more than $2.1 billion in payments, while 2013–2021 accounted for 3,075 reports totalling about $2.4 billion. Ransomware peaked in 2023 with 1,512 incidents and $1.1 billion paid, up 77% from 2022; in 2024 incidents dipped to 1,476 and payments to about $734 million.

Median payments shifted to $175,000 in 2023, compared with $124,097 in 2022 and $155,257 in 2024, with most payments under $250,000. FinCEN identified 267 ransomware variants, led by ALPHV/BlackCat, Akira, LockBit, Phobos and Black Basta, and Akira had the highest number of incidents (376) while ALPHV/BlackCat accounted for the highest total value of transactions (approximately $395.3 million).

The report notes TOR as the top communication channel (67%), with nearly all payments (97%) made in Bitcoin, and funds laundered mainly through unhosted crypto wallets and CVC exchanges.