Google study finds ransomware victims have paid $25M+ in ransoms over last two years
Ransomware victims have paid more than $25 million in ransoms over the last two years, according to a study presented today by researchers at Google, Chainalysis, UC San Diego, and the NYU Tandon School of Engineering.
Context & Ripple Effects
This study is the first hard measurement of ransomware's cash economy, and it lands a year after Cisco estimated ransomware at roughly $300 per victim and $34M a year. By tracing actual bitcoin wallets rather than surveying victims, Google, Chainalysis, UC San Diego and NYU Tandon turn anecdote into an auditable ledger — the methodology Chainalysis would go on to publish annually.
First-order effects
- Ransomware operators' revenue is now quantified from the blockchain itself, giving security teams, insurers, and law enforcement a baseline ($25M+ over two years) for sizing the threat instead of relying on victim surveys.
Second-order effects
- Once payments are traceable on-chain, follow-on research can track them quarter by quarter — which is exactly what happened, with Coveware logging averages climbing to $220K by Q1 2021 before the curve turned.
Third-order effects
- The same ledger shows the endgame: by 2024 attackers collected ~$813.55M, down 35% from 2023's record, as more victims refused to pay — suggesting sustained measurement itself pressures the ransom economy by making non-payment the visible norm.
The trend: Blockchain analytics has turned ransomware from an unmeasured nuisance into a tracked market whose payment totals rise with attacker sophistication and fall as victim refusal spreads.