Ransomware Attacks Rose 50% in 2025 According to Chainalysis Report

​The number of ransomware attacks rose 50% in 2025 as hackers shifted their focus from large-scale attacks to small and medium-sized targets, according to blockchain analytics firm Chainalysis.

In an annual report published on Wednesday, Chainalysis said there were nearly 8,000 total leak events in 2025, a 50% increase from 2024. However, total on-chain ransom payments amounted to $820 million, marking an 8% decrease from 2024.

Chainalysis said increased regulatory scrutiny, enforcement actions targeting laundering network infrastructure, and a general refusal by big firms or organizations to pay ransoms all contributed to lower overall payments in 2025, forcing attackers to go after smaller targets. 

“We’re seeing a structural shift in targeting: fewer large, headline-grabbing intrusions and more volume focused on small and medium enterprises. The assumption is simple — smaller victims pay faster,” eCrime.ch founder Corsin Camichel said in the report, adding:  

“However, Chainalysis’ data shows payments trending downward despite an all-time high in public claims. That divergence is important. It suggests attackers are working harder for diminishing returns.”

Meanwhile, the increase in attempted attacks was attributed to a continued decline in the average “price for victim access” on the dark web, from $1,427 at the start of 2023 to $439 at the start of 2026.