Crypto: Ransomware Incidents Up 50% In 2025, But Payments Stay Flat 2026
A new Chainalysis report suggests ransomware attackers are “working harder for diminishing returns” as regulatory pressure and refusals to pay have hurt ransom proceeds.
The number of ransomware attacks rose 50% in 2025 as hackers shifted their focus from large-scale attacks to small and medium-sized targets, according to blockchain analytics firm Chainalysis.
In an annual report published on Wednesday, Chainalysis said there were nearly 8,000 total leak events in 2025, a 50% increase from 2024. However, total on-chain ransom payments amounted to $820 million, marking an 8% decrease from 2024.
Chainalysis said increased regulatory scrutiny, enforcement actions targeting laundering network infrastructure, and a general refusal by big firms or organizations to pay ransoms all contributed to lower overall payments in 2025, forcing attackers to go after smaller targets.
“We’re seeing a structural shift in targeting: fewer large, headline-grabbing intrusions and more volume focused on small and medium enterprises. The assumption is simple — smaller victims pay faster,” eCrime.ch founder Corsin Camichel said in the report, adding:
Meanwhile, the increase in attempted attacks was attributed to a continued decline in the average “price for victim access” on the dark web, from $1,427 at the start of 2023 to $439 at the start of 2026.
A flood of cheap software and ransomware strains on the market, combined with AI integrations to streamline attacks, has resulted in increased output by hackers, Chainalysis said.
“We are seeing industrialized access pipelines, AI-assisted tooling, and a proliferation of infostealer logs that lower the barrier to entry, which has resulted in an oversupply of cheap but operationally constrained inventory that floods the market and depresses pricing.”
Despite a modest reduction in blockchain ransomware payments last year, 2026 has kicked off with some big losses from crypto exploits and scams.
Related: Why address poisoning works without stealing private keys
Source: CoinTelegraph
