Zscaler ThreatLabz and Chainalysis say ransomware group Dark Angels received a payment worth ~$75M in early 2024, the largest known ransomware payment to date
Lawrence Abrams / BleepingComputer :
Context & Ripple Effects
The reported payment is an extreme single-victim event within a ransomware market that had already reached a record $1.1B in payments during 2023. It makes the economics of a successful intrusion visible at a scale far beyond the earlier group-level earnings cited in related coverage.
It also complicates the aggregate picture: Chainalysis later estimated that 2024 payments fell as more victims refused to pay, yet this case shows that fewer payments need not mean lower exposure for organizations facing the most severe incidents.
First-order effects
- Dark Angels gains an unusually large pool of funds from one reported payment, strengthening the immediate financial incentive for high-impact extortion campaigns.
- The victim and its incident-response, legal, and insurance stakeholders must manage the operational and disclosure consequences of a payment whose size is now publicly reported as a record.
Second-order effects
- A payment of this size raises the stakes for enterprises and their insurers to test recovery, negotiation, and business-interruption plans rather than treat ransomware as a routine security event.
- Rival ransomware operations and their affiliates have evidence that targeting organizations with high downtime costs can yield outsized returns, even as more victims were reported to be refusing payment in 2024.
Third-order effects
- If very large payouts persist alongside lower overall payment totals, ransomware risk may become more concentrated: fewer successful incidents, but potentially more financially consequential ones.
- The later combination of falling total payments and rising claimed victims in 2025 ransomware-payment data suggests that payment-volume metrics alone may be an incomplete measure of the threat; the distribution of payment sizes will matter more.
The trend: Ransomware is evolving toward a high-severity extortion market in which resilience and willingness to pay can matter as much as attack volume.