Blockchain-verified ransomware payments tracked via on-chain analysis. All-time cumulative data across 20 groups and 8,248 unique addresses.
Source: Ransomwhere.org. Tracked amounts represent a floor estimate — actual payments are likely significantly higher.
ALL-TIME TRACKED
$1.0B
GROUPS WITH PAYMENTS
20
UNIQUE ADDRESSES
8,248
Our blockchain analysis tracked $1.02 billion in ransomware payments across 21,802 transactions — a conservative floor that likely represents 15-20% of actual ransom flows given the challenges of attributing cryptocurrency addresses to specific groups. This tracking encompasses 8,248 unique addresses, suggesting sophisticated operational security practices where groups rotate payment infrastructure frequently to evade detection.
The revenue concentration reveals a bifurcated ransomware economy. The top five groups control $895 million — 88% of tracked payments — indicating that while ransomware-as-a-service has democratized attack capabilities, the big money still flows to a small cohort of elite operators. Notably, $682 million sits in "Unlabeled" addresses we cannot definitively attribute, highlighting how successfully major groups compartmentalize their financial operations.
Conti ($102 million, 133 transactions) demonstrates the RaaS revenue model at scale. With an average payment of $764,000 across their December 2017 to June 2022 operational window, they perfected the big-game hunting approach that maximizes profit per victim. Their payment frequency — roughly one major payout every two weeks — suggests systematic targeting of high-value enterprises rather than spray-and-pray tactics.
Cuba ($60 million, 18 transactions) operated at the opposite extreme with an extraordinary $3.3 million average payment. These numbers reflect their laser focus on critical infrastructure and major healthcare systems, where operational disruption costs justify massive ransoms. Their compressed payment timeline (February 2020 to June 2022) and low transaction count indicate a boutique operation prioritizing quality over quantity.
Netwalker ($27 million, 514 transactions) ran a high-volume operation with an average $53,000 payout, reflecting their targeting of mid-market organizations through compromised remote desktop protocol (T1078) and VPN vulnerabilities. Their payment pattern — small, frequent transactions — aligns with automated affiliate programs that scale through volume rather than per-victim revenue.
BlackSuit ($25 million, 3 transactions) achieved an astounding $8.3 million average payment in their brief June 2024 appearance, suggesting either a successor group inheriting Conti's enterprise targeting playbook or a short-lived operation focused exclusively on Fortune 500 victims. This payment concentration within 24 hours indicates coordinated attacks against multiple subsidiaries or a single massive corporate victim.
BlackCat ($22 million, 1 transaction) represents the pinnacle of big-game hunting with their single March 2024 payment. This $22 million payout likely stems from their attack on Change Healthcare, demonstrating how targeting healthcare payment processors can generate ransoms exceeding most groups' annual revenue.
The payment data reveals victims increasingly capitulating to ransomware demands. Groups active in 2024 (BlackSuit, BlackCat, Akira) show dramatically higher average payments than their predecessors, with BlackSuit averaging $8.3 million versus Ryuk's $84,000 in 2018-2019. This trend reflects both attackers' improved targeting of high-revenue victims and organizations' growing willingness to pay rather than face prolonged business disruption.
The proliferation of unique payment addresses — averaging 3.8 transactions per address — demonstrates operational security maturation. Early groups like Locky reused addresses extensively (10,411 transactions across 7,036 addresses), while modern operators compartmentalize payments to frustrate blockchain analysis. This evolution reflects law enforcement pressure and sanctions designations making cryptocurrency traceability a critical operational risk.
Group longevity patterns show the ransomware economy's increasing professionalization. Conti operated for 4.5 years, Cuba for 2.3 years, while newer groups like BlackSuit compress their revenue extraction into months rather than years, suggesting either improved law enforcement disruption capabilities or operators' strategic pivots to avoid sustained scrutiny.
These financial flows underscore ransomware's transformation into a systematic wealth transfer mechanism rather than opportunistic cybercrime. With tracked payments exceeding $1 billion — and actual flows likely approaching $5-7 billion — boards must recognize ransomware as a macro-economic threat requiring strategic, not tactical, responses.
Organizations should calibrate cyber insurance coverage against the $3.3 million average payment observed across major groups. Current coverage limits often fall short of modern ransom demands, particularly for critical infrastructure and healthcare organizations that attackers systematically target for maximum payment leverage.
The concentration of revenue among elite groups means defensive resources should prioritize techniques these operators favor: initial access through T1190 (public-facing application exploitation), T1078 (credential access), and T1021 (remote services), rather than defending against the broader ransomware landscape's varied attack vectors.