# The ransomware economy: how crime became a business, and what crypto has to do with it

> Ransomware is not a lone hacker. It is a supply chain: developers rent out the malware, “affiliates” run the attacks, brokers sell access, and negotiators haggle. More attacks, smaller share paid, bigger demands. This explains the shape, and gives crypto its fair place in the story: a payment rail criminals use, and one that leaves a public trail.

Updated 2026-11-03 · Payaries · https://www.payaries.com/blog/ransomware-economy-crime-as-a-business

## How the business works

> **Written 3 November 2026.** Figures are Chainalysis's 2026 Crypto Crime Report as summarised by trade press; Chainalysis counts on-chain payments it can attribute, so true totals are higher. Payaries is a technology platform, not a security adviser. This article reports public information and is not legal or security-consulting advice. Facts in fast-moving stories change — read the primary sources linked below.

- **Ransomware as a service.** Developers write and maintain the malware and take a cut; affiliates carry out intrusions.
- **Initial access brokers** sell footholds in companies, often stolen logins, so attackers skip the hard first step.
- **Double extortion.** Data is stolen before encryption, then the victim is threatened with publication on a leak site, so restoring from backups no longer ends the problem.
- **Pressure timed to hurt.** Retailers and manufacturers lose money by the day when stopped, as the [2025 UK retail attacks](https://www.payaries.com/blog/retail-cyberattacks-ms-coop-jaguar-land-rover) showed.

## The numbers

| Measure | 2024 | 2025 |
|---|---|---|
| On-chain ransomware payments (Chainalysis) | About $892m (revised) | About $820m, down roughly 8%; could rise to about $900m as cases are attributed |
| Leak-site events | n/a | Nearly 8,000, a 50% increase |
| Median payment | $12,738 | $59,556 |

More attacks, fewer and larger payments. The likeliest reading: more victims are refusing to pay, and attackers are pushing harder on those who can. Food and agriculture are a visible target: Food and Ag-ISAC counted 227 ransomware incidents in the sector in the first seven months of 2026, up 62%, per TIME.

## Where crypto fits, honestly

Criminals use crypto because it is fast, cross-border and needs no bank. Colonial Pipeline's 2021 ransom was paid in bitcoin. But public blockchains record every transfer permanently, and the FBI recovered about $2.3 million of Colonial's payment. [Blockchain](https://www.payaries.com/blog/what-is-blockchain) analysis firms such as Chainalysis publish the figures above precisely because the trail exists. Crypto is a tool, like cash or wire transfers, used by criminals and by legitimate businesses. See [what is cryptocurrency](https://www.payaries.com/blog/what-is-cryptocurrency).

> **Payaries's position.** Payaries is a payment gateway for businesses accepting crypto for goods and services. It is not a tool for extortion and the series makes no claim that crypto helps evade any law. Law enforcement agencies generally discourage paying ransoms; seek legal and law-enforcement advice before any decision.

A related lesson from the [Binance hack](https://www.payaries.com/blog/binance-hack-october-2026-what-happened-and-what-users-should-do): the same technology that makes payments instant also makes security failures instant. Controls such as withdrawal limits, signed requests and reconciliation matter more, not less.

## Sources

- [Ransomware payments topped $800 million in 2025: Chainalysis — The Defiant](https://thedefiant.io/news/research-and-opinion/ransomware-payments-topped-usd800-million-in-2025-chainalysis)
- [Ransomware attacks rose 50% in 2025, Chainalysis — Cointelegraph](https://regional-front.cointelegraph.com/news/ransomware-attacks-rose-50-in-2025-chainalysis)
- [‘Unprecedented’ cyberattack targets French supermarket fridges — TIME](https://time.com/article/2026/10/13/france-cyber-attack-cybersecurity-refrigeration-supermarket-food-security/)
- [Gas pipeline cyberattack, ransomware, Colonial — CyberScoop](https://cyberscoop.com/gas-pipeline-cyberattack-ransomware-colonial/)

## Questions

**How much was paid in ransomware in 2025?**
Chainalysis estimated about $820 million in on-chain ransomware payments in 2025, down about 8% from a revised $892 million in 2024, though attacks claimed on leak sites rose about 50% to nearly 8,000 and the median payment rose to about $59,556.

**What is ransomware as a service?**
A business model in which developers rent out ransomware to affiliates who run the attacks and share the proceeds, lowering the skill needed to attack.

**Are the supermarket fridge attacks ransomware?**
Not as reported: no ransom demand or file encryption has been described, only remote manipulation of refrigeration controllers. See our analysis.

**Does crypto make ransomware untraceable?**
No. Public blockchains record transfers permanently, and investigators including the FBI have traced and recovered ransom payments, as in the Colonial Pipeline case.

## Try it

Run a real invoice before you commit: [Payaries — www.payaries.com](https://www.payaries.com/signup). Payaries is a multi-chain crypto payment gateway — https://www.payaries.com

## Keep reading

- https://www.payaries.com/blog/critical-infrastructure-cyberattacks-explained — Pipelines, power and water: why critical infrastructure is a cyber target
- https://www.payaries.com/blog/retail-cyberattacks-ms-coop-jaguar-land-rover — Shelves, showrooms and assembly lines: what the M&S, Co-op and Jaguar Land Rover attacks taught us
- https://www.payaries.com/blog/what-is-cryptocurrency — What is cryptocurrency? A plain-English guide
- https://www.payaries.com/blog/binance-hack-october-2026-what-happened-and-what-users-should-do — The Binance hack: what happened, what Binance has promised, and what users should do now
- https://www.payaries.com/blog/how-to-defend-against-cyberattacks-what-works — How to defend against cyberattacks: the checklist that matches how attacks actually happen