Analysis: ransomware attackers received at least ~$457M in 2022, a low estimate, down from ~$766M in 2020 and 2021, as victims increasingly refuse to pay
a huge drop of 40.3%. In this blog, we break down this phenomenon and explore some key ransomware trends from the past year. 🧵https://blog.chainalysis.com/ ... https://twitter.com/... https://twitter.com/...
Context & Ripple Effects
This 2022 reading looked like a break in ransomware's growth curve: after gangs made at least $350M in 2020, up 311% YoY under strains like Ryuk, Chainalysis now counts at least ~$457M flowing to attackers in 2022 — a 40% drop — with the stated driver being victims increasingly refusing to pay.
The subsequent coverage shows the refusal-to-pay effect was real but not linear: payments rebounded to a record $1.1B in 2023, then fell again to ~$813M in 2024 and $820M in 2025 — even as 2025 set a record for claimed victims. This report is the first data point in what became a recurring pattern of revenue declines against rising attack volume.
First-order effects
- Ransomware operators' on-chain take fell roughly 40% versus the ~$766M of 2020–2021, cutting the war chest available for affiliates, tooling, and recruiting right now.
- Victim organizations that refuse to pay avoid ransom outlays entirely, shifting the immediate cost burden from extortion payments toward recovery spending.
Second-order effects
- With fewer victims paying, attackers concentrate on extracting more from those who do — the pattern the later data confirms, with 2025's median payment up 368% YoY to nearly $60K despite total payments falling 8%.
- Payment-volume volatility pushes gangs to scale attack volume instead: 2025 saw a record 50% rise in claimed victims even as revenue slipped, meaning more organizations face attacks regardless of whether they pay.
Third-order effects
- If the pattern holds, ransomware settles into a big-game structure: fewer, larger demands aimed at high-value targets, with aggregate revenue tracking victims' willingness to pay rather than attack counts — making non-payment policy a genuine economic weapon against the ecosystem.
- On-chain attribution work like Chainalysis's becomes a standing input into how insurers, regulators, and boards weigh paying ransoms, since each annual revision reshapes the perceived payoff of compliance.
The trend: Ransomware revenue is decoupling from attack volume as victim refusal hardens, pushing operators toward fewer but larger demands rather than broad-based extortion.