Ransomware Payment Rate Fell to 28% in 2025 as Claimed Attacks Rose

Summary

Chainalysis estimates that 28% of ransomware victims paid in 2025 despite a roughly 50% rise in claimed attacks. On-chain payments reached $820 million and may exceed $900 million as more events are attributed; the median payment rose to $59,556.

Key points

Chainalysis reported that the ransomware victim payment rate fell to 28% in 2025, down from 62.8% in 2024.
Claimed ransomware attacks rose roughly 50% year over year, while on-chain payments reached $820 million; Chainalysis said the total may approach or exceed $900 million as more payments are attributed.
The median ransom payment increased 368% year over year, from $12,738 to $59,556.
Chainalysis counted 85 active extortion groups in 2025, reflecting a more fragmented ransomware ecosystem.
Initial access brokers reportedly earned $14 million in 2025. Chainalysis observed that increases in broker payment inflows were followed by rises in ransomware payments and victim leak posts about 30 days later.
The average price for network access fell from about $1,427 in Q1 2023 to $439 in Q1 2026.

Article Details

Publisher: Chainalysis
Report Period: 2025
Scope: Global ransomware payments, extortion groups, and initial access broker activity
Key Statistics: The victim payment rate was 28% in 2025, down from 62.8% in 2024; Chainalysis describes this as a record low.
Claimed ransomware attacks increased by approximately 50% year over year, while the total number of payments remained relatively stable.
On-chain ransomware payments for 2025 stood at $820 million; Chainalysis said the total may approach or exceed $900 million as more events and payments are attributed.
The median ransom payment rose 368%, from $12,738 in 2024 to $59,556 in 2025.
Chainalysis observed 85 active extortion groups in 2025.

Threat Actors

Scattered SpiderThe article attributes the Marks & Spencer breach to Scattered Spider.

Vendors

ChainalysisA downward payment trend has been observed for the past four consecutive years by the blockchain intelligence platform Chainalysis.

Countries

CanadaFor another year, the most targeted country was the United States, followed by Canada, Germany, and the U.K., showing threat actors’ preference for concentrating their efforts in developed economies.GermanyFor another year, the most targeted country was the United States, followed by Canada, Germany, and the U.K., showing threat actors’ preference for concentrating their efforts in developed economies.United KingdomFor another year, the most targeted country was the United States, followed by Canada, Germany, and the U.K., showing threat actors’ preference for concentrating their efforts in developed economies.United StatesFor another year, the most targeted country was the United States, followed by Canada, Germany, and the U.K., showing threat actors’ preference for concentrating their efforts in developed economies.