Fewer victims paying ransoms may change the way attackers operate, but the risk of financial loss remains high
Ransomware attacks involving cryptocurrency saw a significant increase in 2025, with hackers shifting focus toward smaller businesses and medium-sized targets. According to blockchain analytics firm Chainalysis, there were nearly 8,000 ransomware incidents last year, a 50% rise from 2024. Despite the higher number of attacks, total on-chain ransom payments fell to $820 million, down 8% from the previous year.
Experts attribute the decline in payments to stronger enforcement and growing reluctance from large organizations to meet ransom demands. Regulatory crackdowns and targeted actions against laundering networks have made paying ransoms riskier. Hackers responded by targeting smaller firms, which are more likely to pay quickly, though the overall payout per attack is dropping.
The market for ransomware access has also shifted. The average price to gain victim access on the dark web has dropped from $1,427 in early 2023 to $439 at the start of 2026. Chainalysis noted that cheap software, numerous ransomware strains, and AI tools have lowered the barrier to entry, allowing attackers to launch more attempts, even if each attempt yields less revenue.
AI-assisted attacks and automated access pipelines are contributing to the growing number of incidents. Infostealer logs and widely available malware kits have flooded the market, creating operational bottlenecks for attackers. Hackers are working harder, but earning less per incident, signaling diminishing returns despite rising volume.
The trend highlights ongoing risks for organizations of all sizes. Smaller businesses are especially vulnerable, facing faster but lower-value attacks. Meanwhile, crypto-related scams and exploits remain a threat, with cybersecurity firms reporting significant losses from phishing and other attacks in early 2026.
