Ransomware payments fell to approximately $820 million in 2025, even as the total number of attacks reached record highs, according to data from Chainalysis.
The decline marks a notable shift in the economics of cybercrime, suggesting that while attacks are increasing, fewer victims are choosing, or managing, to pay.
After peaking in 2023 at $1.23 billion, ransomware-related payments have now declined for two consecutive years.
The drop in payments despite rising attack volume may point to several structural changes:
Blockchain analytics has also made it increasingly difficult for ransomware groups to cash out anonymously at scale.
While total payments are down, the surge in attack attempts suggests that ransomware groups are adapting. Instead of relying on fewer, large payouts, some operators appear to be increasing volume and targeting smaller organizations.
The data indicates that the business model is under pressure, but far from disappearing.
In short: more attacks, less revenue per year.
That shift could signal a gradual erosion of profitability in large-scale ransomware operations, even as the threat itself remains persistent.
