Over US$600mln of Bitcoin and other crypto paid in ransomware attacks for second year running

Over US$600mln worth of bitcoin and other cryptocurrency was extorted from companies in ransomware attacks last year, the second year running, according to new research.

In 2021, ransomware attacks led to at least US$602mln being paid to attackers, compared to US$692mln in 2020, a report from Chainalysis has revealed.

A ransomware attack is when hackers demand payment or otherwise they will cause disruption or delete files, usually after victims have unknowingly downloaded malicious software that prevents them from accessing files, systems or networks.

The figures are almost certain to rise as more reports emerge, the blockchain analytics firm said, based on anecdotal evidence and the fact that ransomware payments in the first half of 2021 exceeded that of the first half of 2020.

With noted victims last year including, meat supplier JBS, fuel company Colonial Pipeline, and insurer CNA Financial, which paid a record US$40mln to ransomware hijackers, the UK’s National Cyber Security Centre warned that ransomware is the most dangerous threat for companies.

Law enforcement agencies have begun fighting back, said Chainalysis in a blog post announcing the report, with the US Department of Justice able to track and seize US$2.3mln of the Colonial Pipeline ransom paid.

“Law enforcement’s growing ability to seize payments after they’re made represents a huge step forward in the fight against ransomware. It also serves as one more reason why more victims should report attacks — even if you pay, law enforcement may be able to help you get those funds back,” the blog post said.

While most ransomware criminals demanded bitcoin, it was noted that ever more attackers were demanding Monero, which has heightened anonymity.

“While the vast majority of attackers continue to demand Bitcoin, law enforcement and cybersecurity professionals should keep an eye out for ransom notes requesting Monero or assets associated with other protocols with privacy-enhancing features, as this will change the investigative tactics they must employ,” Chainalysis said.