Chainalysis Says Ransomware Attacks Rose 50% in 2025 as On-Chain Payments Fell

Blockchain analytics company Chainalysis said ransomware groups typically encrypt corporate data and demand payment in cryptocurrency, making on-chain fund flows an important measure of criminal proceeds. Heightened regulatory and law-enforcement pressure in 2025, coupled with a greater tendency among large companies to refuse ransom demands, is reshaping attackers' business models and choice of targets.

Chainalysis' latest report showed that ransomware incidents worldwide rose 50% year on year in 2025 to nearly 8,000. Total on-chain ransom payments, however, fell 8% to $820 million over the same period. As large victims became less willing to pay, attackers shifted to smaller targets with lower ransoms per incident, driving up case numbers even as overall returns declined.