Ransomware and cryptocurrency: money flows and prevention

Imagine arriving at the office to find every file unreadable and a message on the screen: pay in bitcoin by Friday, or the data will be deleted and your clients’ documents published on the internet. That is the script of ransomware, one of the digital crimes that most worries police forces in many countries.

This article explains what this kind of attack is, why it depends so heavily on cryptocurrency, how ransom money moves and is traced, and what authorities in the United States, Europe and Brazil recommend for prevention and response. The goal is protection: nothing here helps anyone carry out or conceal an attack.

What ransomware is

Ransomware is a type of malicious code that makes the data on a device inaccessible, usually through encryption, and demands a ransom payment to restore access. That is the definition in the Internet Security Handbook published by CERT.br (Brazil’s national computer emergency response team), which adds that payment is usually made in bitcoin and that infection typically arrives through an email with a malicious attachment or link, or through the exploitation of outdated systems (CERT.br, Ransomware).

The model has changed in recent years. According to the annual internet organised crime threat assessment by Europol, the European Union’s law enforcement agency, the focus of extortion has shifted from “pay to get your data back” to “pay so your data is not published”. Companies are better prepared to lose data, thanks to backups, but remain vulnerable to leaks. Simultaneous denial-of-service attacks, spam sent to corporate email addresses and phone calls to pressure the victim are also part of the repertoire (Europol, IOCTA 2026).

Ransomware as a service

Many attacks follow the ransomware-as-a-service (RaaS) model. One group develops the software and the infrastructure; other criminals, called affiliates, break into victims and split the ransom with the developers. Europol cites a group that offers affiliates between 80% and 85% of the amount paid.

The result is a fragmented and unstable market. Europol observed more than 120 active ransomware brands in 2025, many short-lived, frequently rebranding and sharing members and infrastructure (Europol, IOCTA 2026). The FBI, for its part, identified 63 new variants in 2025 based on the complaints it received (FBI, 2025 IC3 Annual Report).

Why ransoms are demanded in cryptocurrency

Europol sums up the reason: in 2025, cryptocurrencies were the preferred means of payment in ransomware attacks, mainly because of their relative anonymity and borderless nature (Europol, IOCTA 2026).

In practice, this means three things for the criminal:

• There is no bank in the middle to block the transfer or require identification of the recipient.
• The transaction is fast and irreversible, as on any cryptocurrency network. The article What Bitcoin is and how it works explains why there are no chargebacks.
• The value crosses borders without going through traditional foreign exchange systems.

But “relative anonymity” is the right phrase. On networks such as Bitcoin, every transaction is recorded in a public, permanent ledger, the blockchain (How the Bitcoin blockchain works). Addresses carry no names, but the path of the money is visible to anyone who knows how to analyze it. That is the weak spot investigators exploit.

How ransom money moves

Broadly speaking, the flow described by authorities and blockchain analytics firms has four stages. The description below is deliberately generic: it is meant to help understand the phenomenon, not to reproduce it.

1. Payment. The victim receives instructions to transfer cryptocurrency to an address controlled by the group.
2. Split. The amount is divided between the ransomware operators and the affiliates who carried out the intrusion.
3. Concealment. The criminals try to break the trail. Europol points to the 2025 trends: mixing services (mixers), which blend coins from many sources; the use of coins with built-in privacy features; and chain-hopping through bridges, legitimate tools that move assets from one network to another and that, thanks to their speed and liquidity, have become these groups’ preferred laundering method (Europol, IOCTA 2026).
4. Cash-out. To become traditional money, the funds usually pass through exchanges in countries with weak anti-money laundering controls or through offshore financial centers, according to the same assessment.

The trail and the authorities’ response

Each of these stages leaves marks. Chainalysis, a US blockchain analytics firm, says it has identified the main laundering channels of the ten most active ransomware strains of 2025 and uses these patterns as a kind of “fingerprint” to link payments to groups (Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report). This is the company’s own information, and it sells tracing tools.

Police also go after the laundering infrastructure. In November 2025, with Europol’s support, authorities in Switzerland and Germany took down Cryptomixer, a mixing service used by ransomware groups. According to Europol, more than €1.3 billion in bitcoin passed through it since 2016, and the operation seized more than €25 million in cryptocurrency (Europol, IOCTA 2026).

In the United States, the Treasury uses sanctions. In 2021, the Office of Foreign Assets Control (OFAC), the agency that administers US economic sanctions, added a cryptocurrency exchange, SUEX, to its sanctions list for facilitating transactions for at least eight ransomware variants (OFAC, Updated Advisory).

What the numbers show and what they do not

Measuring ransomware is hard, because many victims neither report it nor disclose whether they paid. Each source sees part of the problem:

• Chainalysis (company data): ransomware payments recorded on blockchains totaled more than US$820 million in 2025, a drop of about 8% from 2024. The company itself warns that the figure is likely to rise to nearly US$900 million as more payments are attributed. It estimates that the share of victims who paid fell to 28%, the lowest on record, while the median payment rose from US$12,738 to US$59,556 (Chainalysis).
• FBI: the Internet Crime Complaint Center (IC3) received more than 3,600 ransomware complaints in 2025, with reported losses above US$32 million. The FBI notes that this figure does not include lost business, downtime or recovery costs, and that not all victims report losses, which makes the number artificially low (FBI, IC3).
• Europol: describes ransomware as the dominant threat in the European Union, with attacks growing steadily in 2025 (Europol).

The gap between US$32 million and US$820 million is not a contradiction: the FBI counts only what victims reported to it, while Chainalysis estimates payments traced on blockchains worldwide. Neither portrays the total cost, which includes service disruption and data leaks.

Paying the ransom: risks and the authorities’ position

The decision to pay is usually made under enormous pressure. The official sources consulted point in the same direction:

• There is no guarantee. CERT.br states that paying the ransom does not guarantee data recovery (CERT.br). The No More Ransom project, run by Europol, the Dutch police and partners, adds that paying funds the criminals’ business model (No More Ransom).
• There may be legal risk. OFAC says the US government “strongly discourages” the payment of ransoms. Individuals and companies subject to US law may face civil liability for paying a sanctioned party even without knowing it, and license applications for such payments are reviewed case by case with a presumption of denial. Reporting the attack promptly to authorities and cooperating with them counts as a mitigating factor (OFAC).

The OFAC warning applies to those under US jurisdiction, but it highlights a risk that any company with operations or partners in the United States needs to consider. This article is not legal advice; in a real attack, involve lawyers and the authorities.

How to prevent it

The #StopRansomware guide, published by CISA, NSA, FBI and MS-ISAC, and the FBI report bring together the most frequently cited measures (CISA, #StopRansomware Guide; FBI, IC3):

1. Backups out of the attack’s reach. Offline, encrypted and, according to the FBI, immutable copies, meaning they cannot be altered or deleted. And tested: a backup that has never been restored is a gamble.
2. Multi-factor authentication on every service possible, preferably phishing-resistant, with priority for email, VPN and administrative accounts.
3. Up-to-date patches, starting with vulnerabilities already being exploited in internet-facing systems.
4. Fewer open doors: do not leave remote desktop access exposed to the internet, disable unnecessary protocols and eliminate default passwords.
5. Least privilege and segmentation: each account accesses only what it needs, and the network is divided so an infection does not spread everywhere.
6. Detection: managed antivirus and endpoint detection and response tools on workstations and servers, because ransomware usually arrives after an earlier intrusion.
7. Anti-phishing training and email filters.
8. An incident response plan, rehearsed and also kept on paper and off the network, stating whom to call and how to communicate if systems go down.

For home computer users, CERT.br’s recipe is shorter and just as important: updated operating system and software, antivirus, care with links and attachments, and regular backups, because they are the only guarantee of recovering files (CERT.br). The same caution with fake links applies to anyone holding crypto assets, as shown in the article on crypto wallet phishing.

If an attack happens

The #StopRansomware guide includes a checklist for the first hours. Among the main steps (CISA):

• Isolate the affected systems from the network immediately.
• Communicate out of band, outside the compromised systems, so attackers cannot follow the response.
• Avoid shutting down machines, unless they cannot be disconnected, to preserve evidence in memory.
• Prioritize restoring critical systems from clean backups, and change passwords only after the environment is clean.
• Contact the authorities, who may know of decryption tools.

Before any decision about a ransom, it is worth checking No More Ransom, which offers free decryption tools for many ransomware families (No More Ransom). There is no tool for every case, but checking costs nothing.

Obligations in Brazil

If the attack affects personal data and may create a significant risk or harm to data subjects, Brazil’s General Data Protection Law (LGPD) requires the controller to report the incident. Under ANPD Board Resolution No. 15/2024, the deadline is three business days to notify the ANPD (Brazil’s National Data Protection Authority) and the affected data subjects, counted from the moment the controller learns that personal data were affected, unless a specific law sets a different deadline. Incomplete information may be supplemented within 20 business days (ANPD, Comunicação de incidente de segurança). It is worth remembering the rule’s own caveat: specific laws may set different deadlines.

Reporting the crime to the police is also recommended by the authorities consulted, as it is for scams against individuals, the subject of the article on digital financial scams.

Key takeaways

• Ransomware is extortion: besides locking files, groups threaten to publish stolen data. Cryptocurrencies are the preferred means of payment because of their speed and lack of borders, not because they are invisible.
• Public blockchains leave a trail; mixers, cross-chain swaps and exchanges with weak controls try to erase it, and police and analytics firms work to reconstruct it. The available figures are partial estimates.
• Paying guarantees nothing and may carry legal risk. Tested offline backups, strong authentication, updates and a rehearsed response plan are the best defense; in Brazil, incidents involving personal data must be reported to the ANPD.