Total on-chain ransomware payments fell 8% YoY to $820M in 2025, despite a record 50% rise in claimed victims; the median payment grew 368% YoY to nearly $60K
Context & Ripple Effects
Ransomware payment flows have been volatile: the 2022 drop in observed proceeds was followed by a record payment total in 2023, then a lower 2024 total as more victims reportedly declined to pay. The new figures extend the lower-revenue pattern without indicating fewer claimed incidents.
The divergence between claimed victim volume, aggregate on-chain receipts, and median payment makes total payment value a less complete proxy for ransomware activity than it was during the earlier revenue spikes.
First-order effects
- Ransomware operators collectively captured less observable on-chain revenue in 2025, despite the increase in claimed victims.
- Victims that did pay faced a much higher typical demand or settlement, with the median on-chain payment nearing $60,000.
Second-order effects
- Incident-response teams, insurers, and blockchain investigators will need to separate claimed attack volume from confirmed payment flows; aggregate receipts alone now obscure the incident picture.
- The combination of lower total proceeds and a sharply higher median payment points to a more uneven payment distribution, increasing the importance of tracking payment conversion as well as attack claims.
Third-order effects
- If this divergence persists, ransomware will be measured increasingly as two linked but distinct markets: attack exposure and monetized extortion, rather than through payment totals alone.
- A sustained concentration of payments in fewer or higher-value cases could make aggregate on-chain revenue more volatile even when reported victim counts continue to rise.
The trend: Ransomware activity and ransomware monetization are decoupling, making payment data an incomplete standalone gauge of the threat.