A look at the ruthless Eastern European ransomware gang Ryuk, which hit 235+ US hospitals since 2018 and collected an estimated $100M in ransom last year
Context & Ripple Effects
This profile caps an escalation arc the coverage has tracked for two years: researchers counted roughly $3.7M in Bitcoin from Ryuk by January 2019, when the gang was already notable for only targeting large organizations and lying dormant inside networks before detonating. By October 2020 the FBI was investigating attacks on more than two dozen US hospitals in a single wave, with officials urging backups.
Chainalysis put total ransomware revenue at $350M for 2020, up 311% year over year, with Ryuk as the top earner ahead of the defunct Maze — so a gang pulling an estimated $100M in one year is roughly a quarter to a third of the entire measured market, which explains why the WSJ treats it as a standalone story rather than another attack brief.
First-order effects
- US hospitals remain the immediate exposure: they are the named victim class across the coverage, facing both encryption of systems and the ransom demands that produced the gang's estimated $100M haul last year.
- Exchanges handling the proceeds face direct scrutiny — reporting traced Ryuk operators' earnings, estimated at $150M+ in Bitcoin, being cashed out through Binance and Huobi, putting those platforms at the center of any follow-up enforcement.
Second-order effects
- Hospitals' forced response — the backup-systems warnings issued during the FBI investigation — shifts security spending toward redundancy and incident response, a budget line competitors like NetWalker and Dharma also benefit from as their targets harden unevenly.
- Successor crews inherit the playbook: Qilin's weeks-long disruption of London hospitals with a $50M demand shows the hospital-targeting model outliving Ryuk itself, with new groups competing for the same high-resource victims.
Third-order effects
- If hospital-targeting keeps paying at this scale, ransomware against critical care becomes a standing national-security issue drawing law enforcement into exchange-level tracing — pressuring Binance, Huobi, and peers on how ransom proceeds move through them.
- The economics point toward consolidation of the criminal market around a few high-volume strains, mirroring how Chainalysis already ranks earners like Ryuk and Maze — meaning disruption of one gang matters less than disrupting the cash-out infrastructure all of them share.
The trend: Ransomware is industrializing around a handful of top-earning strains that target high-resource institutions like hospitals, with blockchain analytics and exchange scrutiny becoming the main lever against them.