The number of ransomware attacks rose 50% in 2025 as hackers shifted their focus from large-scale attacks to small and medium-sized targets, according to blockchain analytics firm Chainalysis.
In an annual report published on Wednesday, Chainalysis said there were nearly 8,000 total leak events in 2025, a 50% increase from 2024. However, total on-chain ransom payments amounted to $820 million, marking an 8% decrease from 2024.
Chainalysis said increased regulatory scrutiny, enforcement actions targeting laundering network infrastructure, and a general refusal by big firms or organizations to pay ransoms all contributed to lower overall payments in 2025, forcing attackers to go after smaller targets.
“We’re seeing a structural shift in targeting: fewer large, headline-grabbing intrusions and more volume focused on small and medium enterprises. The assumption is simple — smaller victims pay faster,” eCrime.ch founder Corsin Camichel said in the report, adding:
“However, Chainalysis’ data shows payments trending downward despite an all-time high in public claims. That divergence is important. It suggests attackers are working harder for diminishing returns.”
Meanwhile, the increase in attempted attacks was attributed to a continued decline in the average “price for victim access” on the dark web, from $1,427 at the start of 2023 to $439 at the start of 2026.
A flood of cheap software and ransomware strains on the market, combined with AI integrations to streamline attacks, has resulted in increased output by hackers, Chainalysis said.
“We are seeing industrialized access pipelines, AI-assisted tooling, and a proliferation of infostealer logs that lower the barrier to entry, which has resulted in an oversupply of cheap but operationally constrained inventory that floods the market and depresses pricing.”
Hackers and scammers causing crypto chaos
Despite a modest reduction in blockchain ransomware payments last year, 2026 has kicked off with some big losses from crypto exploits and scams.
Related: Why address poisoning works without stealing private keys
According to a recent report from cybersecurity company CertiK, a whopping $370.3 million in crypto was stolen in January through exploits and scams. The lion’s share of funds was stolen via phishing scams, which accounted for $311.3 million.
Magazine: South Korea gets rich from crypto… North Korea gets weapons