Ransomware gangs raked in at least $350 million in ransom payments in 2020, according to a report released last week by blockchain Chainalysis. The figure was compiled by tracking transactions on blockchain addresses linked to ransomware attacks.
As ZDNet reports, while Chainalysis has one of the most comprehensive datasets on cryptocurrency-related cybercrime , the company estimates that hackers ’ actual profit from ransom payments is actually much higher. This is because not all victims disclosed ransomware attacks and subsequent ransom payments last year.
According to numbers published in a previous report, ransomware payments represented 7% of the total money received from «criminal» cryptocurrency addresses in 2020. The number increased by 311% compared to 2019. Chainalysis attributes this sharp rise to «a series of new executives who received large sums from victims and some existing executives who dramatically increased profits.»
According to the company's data, the top earners of 2020 included the ransomware gangs Ryuk, Maze (now defunct), Doppelpaymer, Netwalker (disrupted by authorities), as well as Conti and REvil/Sodinokibi. Other ransomware, such as Snatch, Defray777 (RansomExx) , and Dharma, also brought in millions of US dollars in profits for hackers.
Additionally, Chainalysis noted that it observed how the scammers moved ransom payments through the blockchain. The company's findings were not very different from previous years, noting that criminals typically laundered» usually money via services “Bitcoin mixing” and then sent the money both to legitimate as well as high‑risk portal cryptocurrency exchanges to convert the funds into real currency.
H Chainalysis also confirmed a report by “Advance Intelligence” published in January 2021, which states that ransomware gangs often use the same money to pay for other cybercrime services. The main finding of this report was that many «cybercrime enterprises» cybercrime – and not only ransomware gangs – frequently used the same intermediary revenue‑laundering services from illegal activities.
This is an important piece of information for the authorities and law enforcement, as it suggests that they can disrupt the activity of multiple officials – specifically, their ability to «launder» and spend cryptocurrencies, setting offline a money laundering function.
The same tactic could also be applied to cryptocurrency exchanges, the points where most of the cash‑out funds exit the blockchain.
