Twenty-six percent. That's the share of ransomware attacks that ended with a payment last year, according to Chainalysis. The other 74%? They failed — the attackers either got nothing or triggered a chain of events that exposed their infrastructure. The headline is a win for the security narrative. But the story beneath the number is messier, and far more instructive for anyone building in crypto today.
I've been tracking this industry since the days when ransomware payments were the single loudest argument against public blockchains. In 2017, every major crypto narrative was framed by the question: "How do you stop criminals from using this?" The answer, then, was "you can't." Now, Chainalysis says the payment success rate has fallen to levels that would have seemed impossible five years ago. Yet the financial losses — the actual dollar amount stolen — remain stubbornly high. This is the paradox that the report doesn't resolve, and it's exactly where the real signal lives.
Context: The Ransomware Economy Before the Drop
Ransomware is not a crypto-native crime. It predates Bitcoin by decades. But the introduction of pseudonymous, irreversible, borderless payments turned a niche nuisance into a global industry. By 2020, the payment success rate was estimated above 70% — attackers could demand a sum, victims would pay, and the funds would move through mixers, exchanges, and eventually into fiat. The ecosystem was professionalized: groups like Conti and LockBit operated like startups, with HR departments, negotiation teams, and support hotlines.
Chainalysis, founded in 2014, built its business on the opposite side of that equation. Its tools—address clustering, graph analysis, and risk scoring—are the digital equivalent of forensic accounting. The company's clients include the FBI, IRS, and major financial institutions. When Chainalysis publishes a report, it's not just data; it's a statement of capability. The 26% figure is their proof that the system works.
Core: How the Success Rate Was Driven Down
The drop from 70%+ to 26% didn't happen by accident. It's the result of three converging forces, all of which are visible on-chain if you know where to look.
First, address clustering has become faster and more automated. In 2020, tracking a ransom payment from a victim's wallet to an exchange might take days. Now, Chainalysis and its competitors (TRM Labs, Elliptic) can flag suspicious addresses in near real-time. The moment a known ransomware wallet receives funds, exchanges can freeze the withdrawal. Attackers can't spend what they can't move.
Second, law enforcement takedowns of major groups have fragmented the ecosystem. The Conti takedown in 2022 and the LockBit disruption in 2024 didn't eliminate ransomware — they pushed the business model toward smaller, amateurish actors. These new attackers lack the operational security of their predecessors. They reuse addresses, fail to launder properly, and leave trails that are easier to follow. Chainalysis calls this "sloppier." I call it a structural shift: the professional class has been replaced by a swarm of desperate copycats.
Third, the cost of successful ransom has fallen relative to the cost of defense. In 2021, a typical ransom demand was $1 million. In 2025, the median is closer to $200,000. But the cost of deploying a ransomware payload hasn't dropped — it's risen, because patches are faster and endpoint detection is better. The ROI for attackers is shrinking. When the expected value of an attack drops below the cost of launching it, the rational actor walks away. The 26% success rate is the statistical expression of that calculus.
But here's where the data gets tricky. Chainalysis only tracks payments that occur on public blockchains and are detected by their models. If a victim pays in Monero, or through a decentralized exchange that doesn't require KYC, the transaction is invisible to their tools. The 26% figure is a lower bound, not an average. The true rate could be higher — we simply don't know.
Yield wasn't the only thing that got crushed in 2022 — the ransomware ecosystem did too. The bear market decimated crypto prices, which made ransom demands less valuable in fiat terms. But it also decimated the liquidity that attackers relied on to cash out. When exchanges tighten compliance and stablecoins freeze suspicious addresses, the exit ramp narrows. The 26% success rate is, in part, a reflection of liquidity constraints, not just better surveillance.
Contrarian: The Blind Spots That Could Resurrect the Narrative
For every victory, the other side adapts. The biggest risk I see is a migration to privacy-first infrastructure. Monero usage in ransomware is already rising. Cross-chain bridges and atomic swaps allow attackers to move funds without touching centralized exchanges. If the next generation of ransomware groups locks into Monero-only payment demands, the Chainalysis model loses its edge overnight. The 26% figure would become a historical artifact, not a trend.
Another blind spot: underreporting. The report notes that financial losses persist, but it doesn't say how many attacks go unreported. Companies that pay but don't report — because they fear regulatory scrutiny or stock price impact — are invisible to the dataset. If the underreporting rate is high, the true success rate could be significantly higher than 26%. The narrative of progress is only as strong as the data that supports it, and that data has a known selection bias.
Finally, there's the moral hazard of the 26% figure itself. If policymakers and market participants interpret this as "the problem is solved," security budgets could shrink. Ransomware is a cat-and-mouse game; the moment defenses relax, the mice get smarter. I've seen this pattern in DeFi — after a few months of low hack numbers, teams stop auditing, and then a big exploit hits. The same cycle applies to ransomware. The 26% number is a snapshot, not a destination.
Takeaway: The Next Narrative Pivot
The 26% success rate is a victory for the crypto security industry, but it's a fragile one. The narrative that "crypto is only for criminals" has been weakened by data, but it hasn't been killed. The real test will come when the next bear market thins out security budgets, or when a new privacy-focused ransomware group emerges that bypasses the existing surveillance networks.
What the market calls a decline in crime, the chain calls a decline in success — but not intent. The attackers are still out there. They're just learning new tricks. The question for the next cycle is whether the detection infrastructure can evolve faster than the evasion techniques. Based on my experience watching this industry pivot from ICO hype to DeFi to NFTs to AI, the answer is always the same: the narrative doesn't settle until the data does. And the data, as always, is incomplete.