Last updated on March 5th, 2026 at 10:15 am
The global ransomware landscape faced a major paradox in 2025, as the number of claimed attacks surged by 50% while total cryptocurrency payments to attackers actually declined.
According to the Chainalysis 2026 Crypto Crime Report, total on-chain ransomware payments fell by approximately 8% to $820 million. This decline occurred despite the record-breaking frequency of incidents, as the percentage of victims who chose to pay ransoms plummeted to an all-time low of 28%.
Source: Chainanalysis
Shifting extortion tactics and median payment growth
While aggregate revenue for ransomware gangs stagnated, the financial impact on individual victims intensified significantly. The median ransom payment grew by a staggering 368% year-over-year, rising from $12,738 in 2024 to nearly $60,000 in 2025. This trend suggests that while fewer organizations are paying, attackers are successfully extracting much larger sums from big game targets in sectors like manufacturing, finance, and healthcare.
The report highlighted high-impact incidents that defined the year, including an attack on Jaguar Land Rover that inflicted over $2.5 billion in economic damage. Other major victims included British retailer Marks & Spencer and kidney dialysis provider DaVita Inc., the latter of which suffered the exposure of 2.7 million patient records.
Decentralisation of the ransomware ecosystem
Law enforcement disruptions have played a critical role in reshaping the threat landscape. Operations like Europol’s Operation Endgame successfully dismantled the infrastructure of several major ransomware families in May 2025.
These actions have scattered the ecosystem, leading to a more decentralised web of smaller, independent operations that often rely on poorly designed malware.
Developments in crypto crime
The decline in ransomware payments aligns with a broader trend of increased resilience within the Web3 industry. Previous DeFi Planet reports have noted that improved cyber hygiene, such as better backup strategies and the use of endpoint detection tools, has empowered more firms to resist extortion.
This progress comes as other illicit sectors show mixed results. While ransomware payments dipped, Chainalysis recently reported that crypto-based human trafficking flows surged 85% in 2025, and total scam losses reached a record $17 billion. These figures underscore that while the industry is winning specific battles against ransomware, the overall illicit crypto economy remains highly adaptive.
Enjoyed this piece? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads and CoinMarketCap Community for seamless access to high-quality industry insights.
“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
