Bitcoin's high transaction fees, delays, and limited anonymity spur cybercriminals towards altcoins like Monero
The popularity of bitcoin is creating problems for criminals dealing in ransomware — and some are already casting their gaze towards a less volatile cryptocurrency.
Context & Ripple Effects
Ransomware economics have run on Bitcoin since cyber-extortionists began demanding bitcoin ransoms from financial-sector targets in 2015, but the coin's own success is now working against its criminal user base: congestion drives fees up and confirmations slow, while a transparent ledger leaves payment trails. The groundwork for an exit was laid earlier — AlphaBay added Monero support back in 2016, giving darknet buyers and sellers a privacy coin with real liquidity.
First-order effects
- Ransomware operators demanding bitcoin payments face slower cash-outs and higher per-transaction costs at exactly the moment victims' negotiators can trace those payments, so gangs that switch to Monero gain both cheaper transfers and obscured sender/receiver identities.
Second-order effects
- Privacy-coin adoption by criminals invites exchange delistings and tighter KYC pressure on the altcoin market, pushing cash-out activity toward the unlicensed exchanges and over-the-counter brokers that forensic firms already track — and giving Bitcoin's legitimate ecosystem a compliance story to sell.
Third-order effects
- If the pattern holds, ransomware becomes multi-chain rather than bitcoin-native — as later coverage of Monero's growing role among ransomware gangs confirms — forcing law enforcement to chase laundering infrastructure instead of following a single public ledger, and eventually contributing to the takedown pressure seen when LockBit and BlackCat were weakened.
The trend: Criminal cryptocurrency preference migrates from transparent coins toward privacy-focused ones whenever traceability or cost makes the default chain untenable.