CHAINALYSIS Update Part 1: Cybercrime Climbs as Exchange Thieves and Ransomware Attackers Grow Bolder

Key findings

Aggregate illicit activity on-chain has dropped by almost 20% year-to-date, demonstrating that legitimate activity is growing more quickly than illicit activity.
Despite the decline in illicit transactions compared to this time last year, two categories of illicit activity — stolen funds and ransomware — are on the rise. Specifically, stolen funds inflows nearly doubled from $857 million to $1.58 billion, while ransomware inflows rose by approximately 2%, from $449.1 million to $459.8 million.

The average amount of cryptocurrency stolen per heist increased by almost 80%.
Part of this is attributable to the rise in the price of bitcoin (BTC), which accounted for 40% of the total transaction volume associated with these heists. Crypto thieves also appear to be returning to their roots by targeting centralized exchanges with greater frequency rather than prioritizing DeFi protocols, which are less popular vehicles for trading BTC.
Advanced cybercriminals, including IT workers linked to North Korea, are increasingly leveraging off-chain methods, such as social engineering, to steal funds by infiltrating crypto-related services.

2024 is set to be the highest-grossing year yet for ransomware payments, due in no small part to strains carrying out fewer high-profile attacks, but collecting large payments (known in the industry as “big game hunting”). 2024 has seen the largest ransomware payment ever recorded at approximately $75 million to the Dark Angels ransomware group.
The median ransom payment to the most severe ransomware strains has spiked from just under $200,000 in early 2023 to $1.5 million in mid-June 2024, suggesting that these strains are prioritizing targeting larger businesses and critical infrastructure providers that may be more likely to pay high ransoms due to their deep pockets and systemic importance.
The ransomware ecosystem has undergone some fragmentation due to recent law enforcement disruptions of the largest players, such as ALPHV/BlackCat and LockBit. Following these disruptions, some affiliates have migrated to less effective strains or launched their own strains.