Does the price of Bitcoin impact ransomware attacks and ransoms

In 2021, the average monthly bitcoin price was just over $47,000 and the average number of monthly publicly-confirmed ransomware attacks was 106. Switch to 2022 (so far) and the average monthly bitcoin price is $31,000 and the average number of monthly ransomware attacks is just over 51.5.

Did the falling price of bitcoin result in fewer ransomware attacks?

To find out, our team of researchers analyzed the average monthly bitcoin price vs. the number of ransomware attacks, the average ransom demanded, and the average ransom paid from 2018 to September 2022. All of the data collated on ransomware attacks comes from our worldwide tracker of publicly confirmed attacks.

What did we find?

We found a strong correlation across a number of areas–both worldwide and in the US.

The price of bitcoin vs. the average ransom demand

The strongest correlations we found were between the price of bitcoin and worldwide ransom demands.

When we compared the price of bitcoin to the average ransom demand, we found a strong correlation (r = 0.73).

As the above table demonstrates, the average ransom demand often follows the price of bitcoin. For example, when the price of bitcoin reaches a monthly high of $61,319 in October 2021, the average ransom demand peaks a month later at $19.5 million.

Using the data available around ransom demands, we have also estimated the average ransom demanded worldwide in total.

Here, when the price of bitcoin spikes in October 2021, so too does the estimated ransom demanded in total, reaching a whopping $1.57 billion. The correlation between these two data sets is r=0.76.

We also see some spikes in 2022, when bitcoin reaches its highest value this year so far ($45,539 in March 2022) and the total estimated ransom demanded reaches its height a month later at just over $1.1 billion. Another smaller spike occurs in July with bitcoin reaching a price of $23,337 and estimated ransom demands hitting over $445 million.

To estimate how much ransom is demanded, we use the average ransom demand for all known cases (as noted in the table below) and multiply by the number of confirmed ransomware attacks we have logged that month. So what about actual ransom demands vs. the price of bitcoin?

Here we see a correlation of r=0.66. In March 2021, we see the biggest peak in ransom demanded with over $134.8 million in total, correlating with a spike in bitcoin price at $58,919. This total ransom demand arises from 13 separate attacks where the amount demanded was confirmed.

In many cases, ransom amounts aren’t given. That’s why the same spike we’ve seen in October 2021 for the estimated demands isn’t seen in the actual demands above. We have only been able to find ransom demands for four attacks in October 2021. This amounted to $62.75 million.

The price of bitcoin vs. the number of ransomware attacks

While the strongest correlations are between the price of bitcoin and the monetary demands made in ransomware attacks, there is still some correlation between bitcoin’s price and the number of successful attacks carried out.

Here, we noted a correlation coefficient of r=0.54.

We almost see a peak in the number of attacks before the bitcoin price spikes. In September 2020, we saw a peak of 193 attacks before bitcoin spiked in March 2021. A height in ransomware attacks is also noted in April 2021 at 171.

Throughout 2022, we noted a lower rate of publicly confirmed ransomware attacks worldwide, which coincides with the drop in bitcoin’s price.

Bitcoin Price vs. Ransomware Attacks & Ransom Demands

DateBTC Price# of AttacksTotal Ransom DemandedAverage Ransom DemandEstimated Ransom Demanded
Jan 201810,221.1013149,50024,917323,917
Feb 201810,397.901168,00034,000374,000
Mar 20186,973.5314206,83768,946965,239
Apr 20189,240.551426,9785,39675,538
May 20187,494.1711343,70085,925945,175
Jun 20186,404.001020,00010,000100,000
Jul 20187,780.441633,52411,175178,795
Aug 20187,037.586341,000341,0002,046,000
Sep 20186,625.5619107,90935,970683,424
Oct 20186,317.611512,0006,00090,000
Nov 20184,017.27148,714,0004,357,00060,998,000
Dec 20183,742.701050,00050,000500,000
Jan 20193,457.7915136,48634,121511,822
Feb 20193,854.79195,0005,00095,000
Mar 20194,105.40291,086,500362,16710,502,833
Apr 20195,350.73311,815,000363,00011,253,000
May 20198,574.5029477,000159,0004,611,000
Jun 201910,817.16292,262,500251,3897,290,278
Jul 201910,085.63559,231,500923,15050,773,250
Aug 20199,630.6638400,000200,0007,600,000
Sep 20198,293.8739508,000254,0009,906,000
Oct 20199,199.5831480,900120,2253,726,975
Nov 20197,569.634623,499,0002,611,000120,106,000
Dec 20197,193.605732,885,7605,480,960312,414,720
Jan 20209,350.53452,040,000340,00015,300,000
Feb 20208,599.51577,127,0001,018,14358,034,143
Mar 20206,438.644811,633,0942,326,619111,677,702
Apr 20208,658.555711,965,3402,991,335170,506,095
May 20209,461.068048,391,0008,065,167645,213,333
Jun 20209,137.99949,483,5001,354,786127,349,857
Jul 202011,323.476523,332,0592,916,507189,572,979
Aug 202011,680.821173,281,068656,21476,776,991
Sep 202010,784.491939,522,7441,904,549367,577,918
Oct 202013,781.0014740,560,0008,112,0001,192,464,000
Nov 202019,625.8413597,675,5008,139,6251,098,849,375
Dec 202029,001.7212011,507,5002,876,875345,225,000
Jan 202133,114.367132,800,00010,933,333776,266,667
Feb 202145,137.7712524,150,0006,037,500754,687,500
Mar 202158,918.83128134,823,30110,371,0231,327,490,964
Apr 202157,750.18171112,164,9728,011,7841,370,015,009
May 202137,332.8616080,750,0008,075,0001,292,000,000
Jun 202135,040.8413910,717,0001,786,167248,277,167
Jul 202141,626.209070,851,86211,808,6441,062,777,927
Aug 202147,166.697353,179,78313,294,946970,531,040
Sep 202143,790.897413,045,6021,863,657137,910,650
Oct 202161,318.9610062,750,00015,687,5001,568,750,000
Nov 202157,005.436358,500,00019,500,0001,228,500,000
Dec 202146,306.457711,890,0003,963,333305,176,667
Jan 202238,483.136719,011,0006,337,000424,579,000
Feb 202243,193.2358N/AN/AN/A
Mar 202245,538.686627,541,3412,754,134181,772,851
Apr 202237,714.886487,010,00017,402,0001,113,728,000
May 202231,792.316312,737,4421,819,635114,636,978
Jun 202219,784.73545,550,0002,775,000149,850,000
Jul 202223,336.904154,295,83310,859,167445,225,831
Aug 202220,049.763630,665,5824,380,797157,708,707
Sep 202219,431.79168,000,0004,000,00064,000,000

Bitcoin price vs. ransomware attacks in the US

As well as our worldwide ransomware tracker, we also log incidents in the US separately. When looking at the same data as above, we do note some correlation between bitcoin’s price and the amount demanded in these attacks.

  • Bitcoin price vs. average ransom demand: r=0.54
  • Bitcoin price vs. average ransom payment: r=0.57
  • Bitcoin price vs. estimated ransom demanded: r=0.59
  • Bitcoin price vs. estimated ransom paid: r=0.58


Our team keeps a daily record of ransomware attacks around the world, noting the ransoms involved (in USD), whether or not they were paid, the number of records affected, and numerous other data points. We used this data alongside the monthly USD price of bitcoin (as noted by Yahoo Finance). Yahoo’s monthly data is based on the price of bitcoin on the 1st of the month, and we used the close price for that date.

To see all of the ransomware attacks and the data used for this comparison, please visit our worldwide ransomware tracker. And for a full list of sources for the ransomware attacks, please request access here