Chainanalysis
6 stats1 reports
Reports
All Statistics
Data leak site-claimed ransomware incidents grew by 50% YoY — an all-time high.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·5mo ago
Data Leak SitesRansomware
On-chain analysis indicates that spikes in IAB inflows typically precede increases in ransomware payments and victim leaks by roughly 30 days.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·5mo ago
IABRansomwareRansom PaymentVictim Leaks
The United States remains the most heavily targeted jurisdiction in leak site activity, followed by Canada, Germany, the UK, and other parts of Europe.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·5mo ago
Data Leak SitesUSCanadaGermanyUK
Total on-chain ransomware payments fell by approximately 8% to $820 million in 2025, even as claimed attacks rose 50%.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·5mo ago
On-Chain Ransomware PaymentsRansomware
The median ransom payment grew 368% year-over-year to nearly $60,000.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·5mo ago
RansomwareRansom Payment
Manufacturing and finance/professional services were the most heavily compromised in leak site activity.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·5mo ago
Data Leak SitesManufacturingFinanceProfessional Services