Ransomware payment data disagrees because it measures different things

What the document says

Three organisations publish recurring ransomware figures built on different data and different definitions. Coveware, a ransomware incident-response and negotiation firm, reports the share of its own handled cases in which a victim paid: 76 percent in 2019 falling to 41 percent across all of 2022 and 37 percent in that year's final quarter, based on the scores of ransomware victims it worked with directly. By the third quarter of 2025, Coveware reported that rate had fallen further, to a historical low of 23 percent across all impact scenarios. Chainalysis, a blockchain analytics firm, instead tracks total dollar value moving into cryptocurrency wallets it has identified as ransomware-linked, and reported that this total exceeded one billion dollars in 2023, a record, after falling to 567 million dollars in 2022. The FBI's Internet Crime Complaint Center reported a far smaller figure for 2024: 12.4 million dollars in direct ransomware losses from 3,156 complaints, which it explicitly states excludes business disruption, remediation and third-party recovery costs.

Confidence and limits

Each figure is well supported for the specific population its publisher actually measures: Coveware's negotiated caseload, Chainalysis's identified on-chain wallets, and IC3's self-reported US complaints. They are not measuring the same thing, so a falling Coveware payment rate and a rising Chainalysis dollar total are not necessarily in tension: fewer victims paying can coexist with a higher total paid if the payments that do happen have grown larger, or if more attacks occurred overall. Chainalysis states its own totals are conservative estimates likely to increase as new ransomware addresses are discovered, and previously revised its 2022 figure upward by 24.1 percent once more wallets were identified. IC3's ransomware figure is explicitly a floor, not an estimate of full economic damage.

Why it mattered

A reader who compares these series without their methods can reach contradictory-sounding conclusions from data that is not actually in conflict. Coverage that quotes a payment-rate decline as proof ransomware is retreating, or a rising blockchain total as proof it is worsening, can both be accurate descriptions of their own metric while missing that neither metric alone describes total ransomware harm.

Defensive takeaway

State which series, and which population, any ransomware statistic describes before citing it in a board report, and avoid combining figures from different publishers into one trend line.

• Does our reporting distinguish a payment rate from a payment total, since a falling rate and a rising total can both be true at once?
• Are we citing a vendor's identified-wallet total as if it were a complete measure of ransomware revenue?
• Have we filed our own incidents with IC3, so the government figure reflects more of what actually happened?

None of these three sources is wrong; each measures its own defined population honestly and says so. The error is treating any one of them as a total, rather than as one labelled slice of a larger picture that no single publisher fully captures.