Ransomware Payments Plummet 35% in 2024: A Turning Tide Against Cyber Extortion

Ransomware extortion payments plummeted by 35% in 2024, according to a recent report by blockchain analytics firm Chainalysis. This significant decline, from a record-breaking $1.25 billion in 2023 to $813 million in 2024, signals a potential shift in the ongoing battle against cyber extortion.

Ransomware, a malicious software, takes control of victims' files, systems, or data and demands a ransom, usually in cryptocurrency, in exchange for a decryption key that restores access. In 2023, the Russian ransomware group Lockbit targeted Evolve Bank, highlighting the growing threat of these attacks.

At the beginning of 2024, it seemed that ransomware payments would continue to rise, with attacks increasing and payments up 2.4% in the first half of the year compared to 2023. However, as the year progressed, the number of victims paying ransoms decreased, leading to a significant drop in overall extortion numbers.

Law enforcement and sanctions played a crucial role in disrupting ransomware laundering in 2024. Sanctions against the Russia-based Cryptex exchange and the seizure of 47 Russian-language crypto exchanges lacking KYC requirements made it more difficult for bad actors to convert stolen cryptocurrency into fiat currency. This disruption led many ransomware groups to hesitate in cashing out their earnings, fearing exposure through blockchain analysis tools.

Despite an increase in ransomware attacks, fewer victims met the attackers' demands in 2024. Chainalysis reported a growing gap between the ransoms demanded and the actual amounts paid, with the gap widening to 53% in the second half of the year. Those who did settle typically sent between $150,000 and $250,000, far less than attackers initially demanded.

The drop in extorted funds signals a potential turning tide against cybercriminals. If the current trend continues, 2025 could bring even more pressure on attackers and fewer payouts for their schemes. However, ransomware remains a significant threat, and organizations must remain vigilant in protecting their data and systems.