What happened
TRM Labs notes that in 2025, the total volume of payments remained at 850illion despite a 44% increase in attacks, creating new opportunities for law enforcement.
Why it matters
The gap between the rising number of attacks and stagnating payments may signal a weakening of the cybercrime economic model, giving security forces a strategic advantage for intervention.
According to TRM Labs data, the ransomware ecosystem underwent significant changes in 2025. The total amount paid to attackers stagnated at approximately 850illion US dollars.
Meanwhile, the number of cyberattack victims increased by 44%. This dynamic indicates that criminals are conducting more attacks, but the average size of successful ransoms is decreasing or the efficiency of obtaining payments is declining.
TRM Labs analysts suggest that the current situation creates new opportunities for disruption of criminal groups by law enforcement agencies in 2026.
Confirmed facts
- According to TRM Labs, ransomware payments in 2025 amounted to approximately 850illion US dollars.
- In 2025, the number of ransomware victims increased by 44%.
- TRM Labs identifies new opportunities for law enforcement to disrupt criminal activities in 2026.
Context
The report was published on April 8, 2026, by TRM Labs, a company specializing in blockchain analytics. The data is based on a meta-analysis of the ransomware market.
What remains unknown
- What specific law enforcement tactics are implied by the new opportunities?
- What exactly caused the decrease in the average ransom amount: regulatory pressure, improved victim protection, or internal conflicts within criminal groups?
- Are these trends confirmed by independent sources other than TRM Labs?
AI analysis
Confidence: medium
Stagnation of revenue amid increasing operational load (number of attacks) often leads to reduced profitability of criminal businesses. This may force less effective groups to cease operations or make mistakes due to lack of resources, which intelligence agencies plan to exploit.
Strategic AI conclusion
A likely consequence will be increased pressure on ransomware infrastructure in 2026. The next observable signal will be reports of specific arrest operations or asset seizures. The key uncertainty lies in the ability of criminals to adapt their monetization models to new conditions.