Chainalysis: ransomware gangs made at least $350M in 2020, up 311% YoY, with the Ryuk strain as the year's top earner, followed by the now-defunct Maze
The figure represents a 311% increase over ransomware payments recorded the previous your, in 2019. — Ransomware gangs …
Context & Ripple Effects
Chainalysis's $350M tally for 2020 was the first full-year on-chain baseline for ransomware, and it set the methodology every later number hangs on: the firm's annual counts went on to track the 2023 record of $1.1B after $983M in 2021, before payments turned down.
The strain ranking matters as much as the total — Ryuk led while Maze, the year's number two, was already defunct, a reminder that brand turnover in this market is fast; months earlier McAfee had placed NetWalker's ~$25M haul in the same league as Ryuk, Dharma and REvil.
First-order effects
- Ryuk operators exit 2020 as the market's top earner, and the defunct Maze's second-place finish confirms that even retired strains banked nine-figure sums during the 311% surge.
Second-order effects
- Rivals like NetWalker, Dharma and REvil are competing in a market whose size is now publicly measurable on-chain, pushing affiliates toward the high-volume big-game targeting that made Ryuk the leader.
Third-order effects
- Chainalysis's ledger-based counting becomes the de facto annual barometer for the sector — the same series later recorded payments falling 35% in 2024 and an 8% drop in 2025 despite a record rise in claimed victims, showing the metric now captures victim refusal to pay, not just gang revenue.
- As the measurement infrastructure gains policy weight, the firm's own disputes over government contracts — including its suit against the US over ICE's $94.6M TRM Labs deal — become part of how ransomware economics is governed.
The trend: On-chain forensics firms like Chainalysis have turned ransomware from an unmeasured criminal niche into an annually benchmarked market, whose arc runs from the 2020 surge through record years to today's falling totals as more victims refuse to pay.