Ransomware extortion drops 35% in 2024 amid crypto exchange crackdowns and increasing refusal to pay: Chainalysis

Ransomware payments dropped 35% to $813 million in 2024 — down 35% from the record-breaking $1.25 billion extorted by cybercriminals the year before, according to blockchain analytics firm Chainalysis.

Per Chainalysis’ 2025 crypto crime report, the attackers had looked set for another record payday in 2024, with the value stolen in the first half of the year up 2.4% on 2023, including $75 million paid by an undisclosed victim to the Dark Angels group. However, a sharp pullback in ransomware payments in the latter half of 2024 meant the value extorted dropped overall.

While centralized exchanges remained a preferred means for the cybercriminals to convert their crypto gains into fiat currencies, sanctions against the Russia-based exchange Cryptex and the German Federal Criminal Police’s seizure of 47 Russian language non-KYC crypto exchanges last year impacted the ability of ransomware actors to launder their illicit earnings, Chainalysis said.

“Ransomware operators, a primarily financially motivated group, are abstaining from cashing out more than ever,” Chainalysis Head of Cyber Threat Intelligence Jacqueline Burns Koven said. “This potentially indicates a fear of being traced, identified, and prosecuted by law enforcement agencies, made possible with the help of crypto investigation tools.” 

More victims refuse to pay

Another positive trend the blockchain analytics firm highlighted is a widening gap between the payouts demanded by attackers and the amounts sent onchain by victims. Despite the number of ransomware events increasing, there was a 53% difference between demands and sends in the second half of 2024, suggesting that while more victims were targeted, fewer paid, Chainlysis said. Victims who did pay attackers typically ended up sending between $150,000 and $250,000 in ransom, regardless of the attackers' initial demands, the firm added.

“For years now, the cybersecurity landscape seemed hurtling towards a so-called ransomware apocalypse, so this sharp decline, to levels even lower than those in 2020 and 2021 speaks to the effectiveness of law enforcement actions, improved international collaboration, and a growing refusal by victims to cave into attackers demands,” Koven said.