The crypto industry saw ransomware payments decline by 35% in 2024, falling to $813 million from the previous year’s $1.25 billion, according to Chainalysis‘ 2025 Crypto Crime Report.
According to the firm, this marks the most significant annual decline in ransomware revenue over the past three years.
Crypto ransomware 2024
Despite an initial uptick in attacks during the first half of 2024 — one victim reportedly paid $75 million to the Dark Angels group — ransomware payments plummeted in the latter half of the year. The report credited the decline to stricter law enforcement action, stronger international cooperation, and growing victim resistance.
Additionally, global authorities have ramped up their crackdown on cybercrime, targeting platforms that facilitate illicit transactions. A prime example is the US and allied countries imposing sanctions on Russia-based crypto exchange Cryptex for enabling money laundering and ransomware-related activities.
Interestingly, while ransomware incidents rose, fewer victims chose to pay. Roughly 30% of negotiations resulted in a ransom payment, with many opting for decryption tools or restoring from backups instead.
Meanwhile, the report also highlights a widening gap between demanded ransoms and actual payments. In the second half of 2024, attackers demanded far more than what victims ultimately transferred, with payments falling short by 53%. Those who did pay sent an average of $150,000 to $250,000—significantly lower than initial demands.
Laundering tactics evolve
As ransomware payments declined, attackers adapted their laundering techniques. Traditionally, ransomware actors relied on mixing services to obscure fund flows, with these platforms processing between 10% and 15% of illicit transactions.
However, law enforcement crackdowns on services like Tornado Cash, ChipMixer, and Sinbad significantly dropped mixer usage in 2024.
Instead, ransomware operators turned to cross-chain bridges to move funds covertly. Centralized exchanges (CEXs) remained a primary off-ramping channel, accounting for 39% of ransomware-related transactions—slightly above the 37% average observed between 2020 and 2024.
Meanwhile, an unexpected trend emerged as a substantial portion of ransom funds remained in personal wallets rather than being cashed out. The shift suggests heightened caution among ransomware actors, who may fear unpredictable law enforcement actions targeting illicit transactions.
Law enforcement’s crackdown on no-KYC exchanges significantly impacted illicit fund flows. In September 2024, German authorities seized 47 Russian-language no-KYC crypto exchanges, while sanctions targeted Cryptex.
Shortly after, ransomware-related inflows to no-KYC platforms dwindled, reinforcing the effectiveness of regulatory actions.
Mentioned in this article
