QUICK BITE

• Overall illicit crypto activity dropped 20% in 2024, but stolen funds nearly doubled to $1.58 billion, with Bitcoin making up 40% of theft volume.
• Ransomware payments increased to $459.8 million, with the largest single payout of $75 million made to the Dark Angels group.
• Criminals are shifting focus back to centralized exchanges, with the average crypto heist value increasing 80% to $10.6 million per event in 2024.

In 2024, the cryptocurrency world has made some positive strides. Crypto is becoming more accepted, especially after the approval of Bitcoin and Ethereum exchange-traded funds (ETFs) in the U.S. and changes to accounting rules by the Financial Accounting Standards Board (FASB). 

However, like with any new technology, both good and bad actors are getting involved. And while illegal activities in crypto have decreased this year, Chainalysis reports some concerning trends with crypto being sent to cybercrime-linked groups.

Illicit activity on blockchain networks has dropped by nearly 20% so far this year, signaling that legitimate transactions are outpacing illegal ones. However, not all the news is good—despite the overall decline, some categories of illicit activity are climbing fast.

Stolen funds and ransomware have seen significant upticks. Inflows from stolen crypto almost doubled, surging from $857 million last year to a staggering $1.58 billion. Meanwhile, ransomware payments are also on the rise, inching up about 2%, from $449.1 million to $459.8 million.

A Closer Look at Stolen Funds

The typical crypto heist now nets criminals much larger rewards. The average amount of value compromised per event has increased by almost 80%, rising from $5.9M per event from January to July of 2023 to $10.6M per event thus far in 2024, based on the value of the assets at the time of theft. 

A key factor in this increase? The rising value of Bitcoin. Bitcoin alone made up 40% of the transaction volume tied to these thefts.

Interestingly, crypto criminals are going back to basics. After a period of focusing on decentralized finance (DeFi) protocols, thieves are once again targeting centralized exchanges. These exchanges, which handle significant Bitcoin transactions, are proving to be attractive targets.

Sophisticated attackers, including cybercriminals with connections to North Korea, are employing old-school tricks like social engineering to infiltrate crypto platforms and services, stealing funds by manipulating employees or exploiting weaknesses.

Ransomware in 2024: The Biggest Year Yet

Furthermore, Chainalysis has also reported that ransomware is on track to have its most lucrative year yet in 2024. This is largely due to a tactic known as “big game hunting,” where attackers bypass smaller targets in favor of larger, more lucrative victims. Instead of making headlines with numerous smaller attacks, ransomware groups are focusing on fewer but much more profitable operations.

One major example: 2024 saw the largest ransomware payout ever recorded—approximately $75 million—paid to the Dark Angels ransomware group.

The trend extends beyond just record-breaking payouts. The median ransom payment for severe ransomware cases has skyrocketed, jumping from just under $200,000 in early 2023 to $1.5 million by mid-2024. High-profile ransomware strains are zeroing in on large businesses and critical infrastructure, betting that these entities, with their deep pockets and vital roles, are more likely to pay hefty sums to resolve attacks quickly.

Law enforcement has cracked down on major players in the ransomware world, disrupting the operations of groups like ALPHV/BlackCat and LockBit. As a result, the ransomware landscape has splintered, with affiliates of these groups branching off to use less effective strains or even launching their own.