How does ransomware use crypto?

Ransomware uses crypto as its payment rail. Attackers break into a network, lock or copy its data, and then demand money to unlock it or to keep it from being leaked. They ask for crypto because it can be sent to an address anywhere in the world, at any hour, without a bank in the middle.

Why do ransomware attackers ask for bitcoin?

A crypto payment does not need a bank account in the attacker's name, and it settles without a business day or a border check. That makes it attractive to groups that operate from countries with little cooperation with Western police. The trade-off for criminals is that most blockchains are public ledgers, so every payment can be followed from address to address, as explained in can cryptocurrency be traced. Attackers often try to hide the trail with tools like crypto mixers before cashing out.

How much is paid in ransomware each year?

The blockchain analysis firm Chainalysis tracked about $820 million in ransomware payments in 2025 and expected the figure to rise toward $900 million as more payments are linked to known gangs, The Record reported. Its 2024 total was first put at $813 million and later revised to $892 million. Fewer victims are paying, with the share falling to a record low of 28%, but claimed attacks rose by 50% and the median payment grew to $59,565 from $12,738.

Is it illegal to pay a ransomware demand?

In the United States, paying a ransom can create legal risk. In an updated advisory issued in 2021, the Treasury's Office of Foreign Assets Control said paying ransomware actors with a sanctions link may violate its rules, and that civil penalties can apply on a strict liability basis, meaning a company can be liable even if it did not know the payee was sanctioned. The general rules are in what OFAC crypto sanctions are.

OFAC said a prompt, complete report of an attack to law enforcement, including any payment, would be treated as a significant mitigating factor. That same month it sanctioned SUEX, a crypto exchange accused of handling transactions for ransomware actors, the first time it had sanctioned a company for supporting them rather than the attackers themselves.

How do authorities fight ransomware payments?

Beyond sanctions, investigators follow payments on-chain and work with exchanges to freeze funds when they reach a platform that can act, as described in can crypto be frozen. Officials also push organizations to keep offline backups, train staff and use strong login protections, which reduces the pressure to pay.

Figures are as reported for each year and may be revised. Rules differ by country, and this guide is not legal advice.