Ransomware incidents surged by roughly 50 percent in 2025, as attackers increasingly pivoted toward small and medium-sized enterprises rather than pursuing large, high-profile corporate breaches. According to blockchain analytics firm Chainalysis, nearly 8,000 leak events were recorded during the year, marking a significant escalation in publicly disclosed attacks compared with 2024. Despite that surge in activity, total on-chain ransom payments declined to $820 million, representing an eight percent drop from the prior year and highlighting a widening gap between attack volume and realized returns. Structural Shift In Criminal Economics Researchers pointed to heightened regulatory scrutiny and enforcement actions targeting laundering infrastructure as key factors constraining attackers’ ability to convert extortion demands into cryptocurrency proceeds. They also cited a growing refusal among large organizations to pay ransoms, which has reduced the financial incentives associated with headline-grabbing corporate intrusions. “We’re seeing a structural shift in targeting: fewer large, headline-grabbing intrusions and more volume focused on small and medium enterprises. The assumption is simple — smaller victims pay faster,” eCrime.ch founder Corsin Camichel said in the report, adding: “However, Chainalysis’ data shows payments trending downward despite an all-time high in public claims. That divergence is important. It suggests attackers are working harder for diminishing returns.” Cheap Access And AI Tools Fuel Volume The increase in attempted attacks has been linked to a sharp decline in the average price for victim network access sold on dark web marketplaces, which fell from $1,427 in early 2023 to $439 at the start of 2026. An influx of inexpensive ransomware strains and automation tools, including artificial intelligence integrations, has lowered barriers to entry and enabled less sophisticated actors to launch campaigns at scale. “We are seeing industrialized access pipelines, AI-assisted tooling, and a proliferation of infostealer logs that lower the barrier to entry, which has resulted in an oversupply of cheap but operationally constrained inventory that floods the market and depresses pricing.” Crypto Losses Continue Into 2026 Although ransomware payments moderated in 2025, the broader cryptocurrency ecosystem continues to face elevated security risks entering 2026, with significant losses recorded from exploits and phishing campaigns. Cybersecurity firm CertiK reported that $370.3 million in crypto assets were stolen in January alone, with phishing scams accounting for $311.3 million of that total. The evolving threat landscape underscores how cybercriminal operations are adapting rapidly to enforcement pressure, combining lower-cost tooling with diversified tactics in pursuit of sustained illicit revenue streams.
