iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ransomware payments fell sharply in 2024, but attacks did not. Chainalysis estimated that ransomware actors received $813.55 million in cryptocurrency payments worldwide, 35% less than the $1.25 billion attributed to 2023. Meanwhile, two attack trackers counted more than 5,200 claimed attacks in 2024, with both reporting high, sustained activity. The payment figure measures money attributed to ransomware actors—not the number of attacks or the total cost of ransomware.
What the $813.55 million figure measures
Chainalysis’s 2025 estimate covers cryptocurrency payments it attributed to ransomware actors during 2024. It is a global estimate of money paid, not a count of victims, ransom demands, recovery costs, lost business, or total economic damage. Chainalysis may revise the estimate as it identifies additional addresses and payments.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Security with Keys, Anti-Theft, Screw Styles | $10.49 | Buy on Amazon |
The comparison is $813.55 million in 2024 versus $1.25 billion in 2023. That is a decline of about $436.45 million, or 35% using Chainalysis’s rounded percentage. The 2023 total was a record, according to Chainalysis.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Did ransomware attacks also decrease?
No. Attack counts remained high and increased in the available 2024 tallies. ODNI’s Cyber Threat Intelligence Integration Center (CTIIC) counted 5,289 attacks worldwide; NCC Group counted 5,263 in its monitor. These are separate counts produced with different methods, so they should not be combined or treated as a definitive census.
#1 Best Overall
- With strict control and, high factors, can be used with peace of mind
- Works with most desktops, docking stations with built-in security locking slot hole
- Fine workmans ship make sure they are perfect to use
- Protect your computer and its valuable data with this computer
- metal, multi-layer plating color, do not fade, long-life
Attack totals based on leak-site posts and other open-source reporting can include duplicate claims, rebranded groups, or inflated claims. CTIIC notes this limitation. Even with that caveat, both counts point to a clear distinction: fewer dollars attributed to payments did not mean fewer reported attacks.
Why did payments fall while attacks stayed high?
Chainalysis attributes the decline in part to law-enforcement action, international collaboration, and more victims refusing to pay. Its analysis also describes payment activity slowing by about 34.9% after July 2024. That timing indicates a slowdown in observed payments; it does not establish how much of the annual decline each contributing factor caused.
There is no single authoritative percentage dividing the fall between disruption of ransomware operations and victims’ decisions not to pay. The evidence supports those as contributing factors, not a precise causal breakdown. Attack pressure can persist even when fewer victims pay, and a payment decline alone does not show that the underlying risk has eased.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Why U.S. figures do not match the global estimate
FinCEN reported 1,476 ransomware incidents and $734 million in payments in 2024, compared with 1,512 incidents and $1.1 billion in 2023. These figures come from U.S. Bank Secrecy Act (BSA) reports. They are an administrative reporting dataset, not the same population or measurement method as Chainalysis’s global cryptocurrency attribution estimate.
| Source and scope | What it counts | 2024 figure | Comparison |
|---|---|---|---|
| Chainalysis, global estimate | Cryptocurrency payments attributed to ransomware actors | $813.55 million | $1.25 billion in 2023 |
| FinCEN, U.S. BSA reports | Reported ransomware incidents and payments | 1,476 incidents; $734 million | 1,512 incidents; $1.1 billion in 2023 |
| ODNI CTIIC, worldwide | Attacks counted through its methodology | 5,289 | 15% more than in 2023 |
| NCC Group monitor | Attacks counted through its monitor | 5,263 | Different methodology from CTIIC |
The figures answer different questions: Chainalysis estimates globally attributed on-chain payments; FinCEN tallies reports submitted under U.S. requirements; and CTIIC and NCC Group count reported attacks. Differences between them are not contradictions, and none can be substituted for another.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Ransom demands rose even as fewer victims paid
Demand size and money collected moved in different directions. Palo Alto Networks Unit 42 reported that the median initial extortion demand in its 2024 cases was $1.25 million, nearly 80% higher than the $695,000 median in 2023. An initial demand is not the same as a negotiated settlement or a payment received.
Arete reported that 29% of the ransomware and extortion victims in its incident-response sample paid in 2024, down from 32% in its 2023 sample. That finding is specific to Arete’s cases; it is not a global victim payment rate. Taken together, these measures show why a higher demand does not necessarily translate into more money collected: some victims pay less than demanded, negotiate, or refuse to pay.
The exceptional $75 million ransom
CTIIC identified a $75 million payment by a Fortune 50 company to Dark Angels as the largest known cyber ransom in 2024. A single exceptional payment can materially affect annual totals, but it does not represent a typical ransom or explain the overall year-over-year decline by itself.
Quick Recap
How to read the 2024 decline
- Payments fell: Chainalysis estimated a 35% drop in globally attributed cryptocurrency payments from 2023.
- Reported attacks did not: CTIIC and NCC Group each counted more than 5,200 attacks in 2024, using different methods.
- Demand is not collection: Unit 42’s initial-demand measure and Arete’s payment rate describe different stages and samples.
- Scope matters: global on-chain estimates, U.S. BSA reports, and open-source attack counts measure different things.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
