01How the business works
- Ransomware as a service. Developers write and maintain the malware and take a cut; affiliates carry out intrusions.
- Initial access brokers sell footholds in companies, often stolen logins, so attackers skip the hard first step.
- Double extortion. Data is stolen before encryption, then the victim is threatened with publication on a leak site, so restoring from backups no longer ends the problem.
- Pressure timed to hurt. Retailers and manufacturers lose money by the day when stopped, as the 2025 UK retail attacks showed.
02The numbers
| Measure | 2024 | 2025 |
|---|---|---|
| On-chain ransomware payments (Chainalysis) | About $892m (revised) | About $820m, down roughly 8%; could rise to about $900m as cases are attributed |
| Leak-site events | n/a | Nearly 8,000, a 50% increase |
| Median payment | $12,738 | $59,556 |
More attacks, fewer and larger payments. The likeliest reading: more victims are refusing to pay, and attackers are pushing harder on those who can. Food and agriculture are a visible target: Food and Ag-ISAC counted 227 ransomware incidents in the sector in the first seven months of 2026, up 62%, per TIME.
03Where crypto fits, honestly
Criminals use crypto because it is fast, cross-border and needs no bank. Colonial Pipeline's 2021 ransom was paid in bitcoin. But public blockchains record every transfer permanently, and the FBI recovered about $2.3 million of Colonial's payment. Blockchain analysis firms such as Chainalysis publish the figures above precisely because the trail exists. Crypto is a tool, like cash or wire transfers, used by criminals and by legitimate businesses. See what is cryptocurrency.
A related lesson from the Binance hack: the same technology that makes payments instant also makes security failures instant. Controls such as withdrawal limits, signed requests and reconciliation matter more, not less.
04Sources
Questions
- How much was paid in ransomware in 2025?
- Chainalysis estimated about $820 million in on-chain ransomware payments in 2025, down about 8% from a revised $892 million in 2024, though attacks claimed on leak sites rose about 50% to nearly 8,000 and the median payment rose to about $59,556.
- What is ransomware as a service?
- A business model in which developers rent out ransomware to affiliates who run the attacks and share the proceeds, lowering the skill needed to attack.
- Are the supermarket fridge attacks ransomware?
- Not as reported: no ransom demand or file encryption has been described, only remote manipulation of refrigeration controllers. See our analysis.
- Does crypto make ransomware untraceable?
- No. Public blockchains record transfers permanently, and investigators including the FBI have traced and recovered ransom payments, as in the Colonial Pipeline case.
Keep reading
- Pipelines, power and water: why critical infrastructure is a cyber targetFrom the Colonial Pipeline shutdown to Volt Typhoon's pre-positioning in water and power networks: why attacks on infrastructure are rising and what they mean.
- Shelves, showrooms and assembly lines: what the M&S, Co-op and Jaguar Land Rover attacks taught usHow the 2025 cyberattacks on Marks & Spencer, Co-op and Jaguar Land Rover show that modern business depends on a few fragile systems, with costs of £80m to about £1.9bn.
- What is cryptocurrency? A plain-English guideWhat cryptocurrency is, how it differs from bank money, how wallets and keys work, the main types (Bitcoin, Ethereum, stablecoins) and how businesses accept it.
- The Binance hack: what happened, what Binance has promised, and what users should do nowBinance says it will cover all losses from the 29 October 2026 hot-wallet hack. What is reported, what is unconfirmed, and practical steps for users and businesses.
- How to defend against cyberattacks: the checklist that matches how attacks actually happenA short, evidence-based defence checklist for a business or shop: exposure, patching, MFA, backups, verification, supplier risk and payment controls, drawn from real 2024–2026 incidents.