Payments to the three Bitcoin addresses reportedly hardcoded in the WannaCry ransomware totaled just $26K by Saturday
As thousands of organizations work to contain and clean up the mess from this week's devastating Wana ransomware attack, the fraudsters responsible for releasing …
Context & Ripple Effects
WannaCry's monetization was almost an afterthought: three hardcoded Bitcoin addresses shared by every victim worldwide, no per-target negotiation, and just $26K collected by Saturday even as thousands of organizations scrambled to contain the Wana outbreak. That design made the attack's finances publicly auditable in real time — anyone could watch the addresses — but it also capped the take at whatever victims chose to send unprompted.
The contrast with what came after is the story. Within a few years, ransomware had industrialized around negotiated per-victim payments: research found average decryption payments hitting ~$84K by late 2019, and groups like NetWalker were pulling in ~$25M in months. Yet the aggregate numbers have since bent downward — 2022 receipts fell well below the 2020–21 peak as more victims refused to pay, a pattern Chainalysis has tracked through 2024 and 2025.
First-order effects
- The operators behind Wana earned roughly nothing relative to the disruption they caused — the hardcoded-address model left them dependent on voluntary payments rather than leverage, while thousands of infected organizations bore the full cleanup cost.
Second-order effects
- The $26K haul against later per-victim averages helped push ransomware crews toward targeted, negotiated extortion — the NetWalker/Ryuk/REvil model — where a single compromised organization pays more than WannaCry's entire global address ever collected.
Third-order effects
- If the refusal-to-pay trend holds, ransomware economics keep bifurcating: fewer total dollars across more claimed victims, with on-chain measurement (as Chainalysis's annual tallies show) making aggregate pressure on the payment ecosystem visible to regulators and insurers.
The trend: Ransomware is migrating from indiscriminate, low-yield campaigns toward concentrated high-value extortion, even as aggregate victim payments decline because paying is no longer the default.