On-chain Ransomware Payments Declined to $820 Million in 2025

Key Insights

• $820 million was paid onchain to ransomware attackers in 2025, an 8% drop from the previous year.
• Ransomware attacks have reached their highest level ever after increasing by 50% in 2025.
• Attackers are increasingly targeting medium and small-scale organizations, even as large-scale attacks remain.

Onchain payments for ransomware attacks were $820 million in 2025, according to a new report by Chainalysis. This represents an 8% decline compared to the estimated $892 million in 2024.

The drop in the amount means it has now fallen for two consecutive years after reaching an all-time high of $1.23 billion in 2023.

Ransomware Victims Reached on Record High in 2025

Interestingly, the total number of ransomware attacks increased substantially last year. According to the Chainalysis report, the number of claimed ransomware victims increased by 50% year over year in 2025. This makes the year the highest on record for ransomware victims.

Unsurprisingly, this meant that 2025 is the year when the ransom paid compared to victims could reach an all-time low of 28%. However, the report noted that the total number of ransom payments could still increase to as much as $900 million once more cases are attributed.

Even with that, the difference between 2024 and 2025 ransomware payments remains minimal, showing stagnation even as attacks increased. The experts attributed this to complex factors within the industry.

These include increased crackdowns on ransomware networks and operators, as well as the decentralization of the ransomware market. Instead of a few dominant attack strains, smaller independent groups have emerged, which makes tracking and attribution more challenging.

Interestingly,  the median ransom payment also increased by 368% in 2025. It went from just $12,738 the year before to $59,556, suggesting that while fewer victims paid, those who did paid much more than the year before.

Ransomware Attackers Increasingly Targeting Medium-Sized Companies

Meanwhile, the report observed that most ransomware attackers target small and medium-sized organizations rather than large companies.

It noted that this approach is due to the assumption that smaller victims are more likely to pay up. The result has been fewer large-scale and headline-grabbing attacks.

Still, the US remains the most heavily targeted region, with Canada, Germany, and the UK also seeing high-volume attacks. Industries mostly targeted in these jurisdictions were manufacturing and finance/professional services, but attackers also targeted logistics, supply chain, and other infrastructure.

However, this does not reflect the standard ransomware attack practice. They appear to be generally opportunistic and more focused on vulnerabilities than the sector.

The report stated:

“Ransomware actors remain highly opportunistic. They do not consistently favor a specific sector at a given time of year. Instead, they exploit exposed services and misconfigurations as they arise, and capitalize on newly disclosed vulnerabilities.”

Despite the prevalence of attacks targeting small and medium-sized enterprises, several major attacks occurred during the year. The most notable was the attack on Jaguar Land Rover, which caused an estimated $2.5 billion in economic loss.

Another attack by the Scattered Spider group also disrupted the British retail group Marks & Spencer’s operations. This also caused the company to incur millions in losses.

The post On-chain Ransomware Payments Declined to $820 Million in 2025 appeared first on The Market Periodical.