In 2021, the average monthly bitcoin price was just over $47,000 and the average number of monthly publicly-confirmed ransomware attacks was 106. Switch to 2022 (so far) and the average monthly bitcoin price is $31,000 and the average number of monthly ransomware attacks is just over 51.5.
Did the falling price of bitcoin result in fewer ransomware attacks?
To find out, our team of researchers analyzed the average monthly bitcoin price vs. the number of ransomware attacks, the average ransom demanded, and the average ransom paid from 2018 to September 2022. All of the data collated on ransomware attacks comes from our worldwide tracker of publicly confirmed attacks.
What did we find?
We found a strong correlation across a number of areas–both worldwide and in the US.
The price of bitcoin vs. the average ransom demand
The strongest correlations we found were between the price of bitcoin and worldwide ransom demands.
When we compared the price of bitcoin to the average ransom demand, we found a strong correlation (r = 0.73).
As the above table demonstrates, the average ransom demand often follows the price of bitcoin. For example, when the price of bitcoin reaches a monthly high of $61,319 in October 2021, the average ransom demand peaks a month later at $19.5 million.
Using the data available around ransom demands, we have also estimated the average ransom demanded worldwide in total.
Here, when the price of bitcoin spikes in October 2021, so too does the estimated ransom demanded in total, reaching a whopping $1.57 billion. The correlation between these two data sets is r=0.76.
We also see some spikes in 2022, when bitcoin reaches its highest value this year so far ($45,539 in March 2022) and the total estimated ransom demanded reaches its height a month later at just over $1.1 billion. Another smaller spike occurs in July with bitcoin reaching a price of $23,337 and estimated ransom demands hitting over $445 million.
To estimate how much ransom is demanded, we use the average ransom demand for all known cases (as noted in the table below) and multiply by the number of confirmed ransomware attacks we have logged that month. So what about actual ransom demands vs. the price of bitcoin?
Here we see a correlation of r=0.66. In March 2021, we see the biggest peak in ransom demanded with over $134.8 million in total, correlating with a spike in bitcoin price at $58,919. This total ransom demand arises from 13 separate attacks where the amount demanded was confirmed.
In many cases, ransom amounts aren’t given. That’s why the same spike we’ve seen in October 2021 for the estimated demands isn’t seen in the actual demands above. We have only been able to find ransom demands for four attacks in October 2021. This amounted to $62.75 million.
The price of bitcoin vs. the number of ransomware attacks
While the strongest correlations are between the price of bitcoin and the monetary demands made in ransomware attacks, there is still some correlation between bitcoin’s price and the number of successful attacks carried out.
Here, we noted a correlation coefficient of r=0.54.
We almost see a peak in the number of attacks before the bitcoin price spikes. In September 2020, we saw a peak of 193 attacks before bitcoin spiked in March 2021. A height in ransomware attacks is also noted in April 2021 at 171.
Throughout 2022, we noted a lower rate of publicly confirmed ransomware attacks worldwide, which coincides with the drop in bitcoin’s price.
Bitcoin Price vs. Ransomware Attacks & Ransom Demands
| Date | BTC Price | # of Attacks | Total Ransom Demanded | Average Ransom Demand | Estimated Ransom Demanded |
|---|---|---|---|---|---|
| Jan 2018 | 10,221.10 | 13 | 149,500 | 24,917 | 323,917 |
| Feb 2018 | 10,397.90 | 11 | 68,000 | 34,000 | 374,000 |
| Mar 2018 | 6,973.53 | 14 | 206,837 | 68,946 | 965,239 |
| Apr 2018 | 9,240.55 | 14 | 26,978 | 5,396 | 75,538 |
| May 2018 | 7,494.17 | 11 | 343,700 | 85,925 | 945,175 |
| Jun 2018 | 6,404.00 | 10 | 20,000 | 10,000 | 100,000 |
| Jul 2018 | 7,780.44 | 16 | 33,524 | 11,175 | 178,795 |
| Aug 2018 | 7,037.58 | 6 | 341,000 | 341,000 | 2,046,000 |
| Sep 2018 | 6,625.56 | 19 | 107,909 | 35,970 | 683,424 |
| Oct 2018 | 6,317.61 | 15 | 12,000 | 6,000 | 90,000 |
| Nov 2018 | 4,017.27 | 14 | 8,714,000 | 4,357,000 | 60,998,000 |
| Dec 2018 | 3,742.70 | 10 | 50,000 | 50,000 | 500,000 |
| Jan 2019 | 3,457.79 | 15 | 136,486 | 34,121 | 511,822 |
| Feb 2019 | 3,854.79 | 19 | 5,000 | 5,000 | 95,000 |
| Mar 2019 | 4,105.40 | 29 | 1,086,500 | 362,167 | 10,502,833 |
| Apr 2019 | 5,350.73 | 31 | 1,815,000 | 363,000 | 11,253,000 |
| May 2019 | 8,574.50 | 29 | 477,000 | 159,000 | 4,611,000 |
| Jun 2019 | 10,817.16 | 29 | 2,262,500 | 251,389 | 7,290,278 |
| Jul 2019 | 10,085.63 | 55 | 9,231,500 | 923,150 | 50,773,250 |
| Aug 2019 | 9,630.66 | 38 | 400,000 | 200,000 | 7,600,000 |
| Sep 2019 | 8,293.87 | 39 | 508,000 | 254,000 | 9,906,000 |
| Oct 2019 | 9,199.58 | 31 | 480,900 | 120,225 | 3,726,975 |
| Nov 2019 | 7,569.63 | 46 | 23,499,000 | 2,611,000 | 120,106,000 |
| Dec 2019 | 7,193.60 | 57 | 32,885,760 | 5,480,960 | 312,414,720 |
| Jan 2020 | 9,350.53 | 45 | 2,040,000 | 340,000 | 15,300,000 |
| Feb 2020 | 8,599.51 | 57 | 7,127,000 | 1,018,143 | 58,034,143 |
| Mar 2020 | 6,438.64 | 48 | 11,633,094 | 2,326,619 | 111,677,702 |
| Apr 2020 | 8,658.55 | 57 | 11,965,340 | 2,991,335 | 170,506,095 |
| May 2020 | 9,461.06 | 80 | 48,391,000 | 8,065,167 | 645,213,333 |
| Jun 2020 | 9,137.99 | 94 | 9,483,500 | 1,354,786 | 127,349,857 |
| Jul 2020 | 11,323.47 | 65 | 23,332,059 | 2,916,507 | 189,572,979 |
| Aug 2020 | 11,680.82 | 117 | 3,281,068 | 656,214 | 76,776,991 |
| Sep 2020 | 10,784.49 | 193 | 9,522,744 | 1,904,549 | 367,577,918 |
| Oct 2020 | 13,781.00 | 147 | 40,560,000 | 8,112,000 | 1,192,464,000 |
| Nov 2020 | 19,625.84 | 135 | 97,675,500 | 8,139,625 | 1,098,849,375 |
| Dec 2020 | 29,001.72 | 120 | 11,507,500 | 2,876,875 | 345,225,000 |
| Jan 2021 | 33,114.36 | 71 | 32,800,000 | 10,933,333 | 776,266,667 |
| Feb 2021 | 45,137.77 | 125 | 24,150,000 | 6,037,500 | 754,687,500 |
| Mar 2021 | 58,918.83 | 128 | 134,823,301 | 10,371,023 | 1,327,490,964 |
| Apr 2021 | 57,750.18 | 171 | 112,164,972 | 8,011,784 | 1,370,015,009 |
| May 2021 | 37,332.86 | 160 | 80,750,000 | 8,075,000 | 1,292,000,000 |
| Jun 2021 | 35,040.84 | 139 | 10,717,000 | 1,786,167 | 248,277,167 |
| Jul 2021 | 41,626.20 | 90 | 70,851,862 | 11,808,644 | 1,062,777,927 |
| Aug 2021 | 47,166.69 | 73 | 53,179,783 | 13,294,946 | 970,531,040 |
| Sep 2021 | 43,790.89 | 74 | 13,045,602 | 1,863,657 | 137,910,650 |
| Oct 2021 | 61,318.96 | 100 | 62,750,000 | 15,687,500 | 1,568,750,000 |
| Nov 2021 | 57,005.43 | 63 | 58,500,000 | 19,500,000 | 1,228,500,000 |
| Dec 2021 | 46,306.45 | 77 | 11,890,000 | 3,963,333 | 305,176,667 |
| Jan 2022 | 38,483.13 | 67 | 19,011,000 | 6,337,000 | 424,579,000 |
| Feb 2022 | 43,193.23 | 58 | N/A | N/A | N/A |
| Mar 2022 | 45,538.68 | 66 | 27,541,341 | 2,754,134 | 181,772,851 |
| Apr 2022 | 37,714.88 | 64 | 87,010,000 | 17,402,000 | 1,113,728,000 |
| May 2022 | 31,792.31 | 63 | 12,737,442 | 1,819,635 | 114,636,978 |
| Jun 2022 | 19,784.73 | 54 | 5,550,000 | 2,775,000 | 149,850,000 |
| Jul 2022 | 23,336.90 | 41 | 54,295,833 | 10,859,167 | 445,225,831 |
| Aug 2022 | 20,049.76 | 36 | 30,665,582 | 4,380,797 | 157,708,707 |
| Sep 2022 | 19,431.79 | 16 | 8,000,000 | 4,000,000 | 64,000,000 |
Bitcoin price vs. ransomware attacks in the US
As well as our worldwide ransomware tracker, we also log incidents in the US separately. When looking at the same data as above, we do note some correlation between bitcoin’s price and the amount demanded in these attacks.
- Bitcoin price vs. average ransom demand: r=0.54
- Bitcoin price vs. average ransom payment: r=0.57
- Bitcoin price vs. estimated ransom demanded: r=0.59
- Bitcoin price vs. estimated ransom paid: r=0.58
Methodology
Our team keeps a daily record of ransomware attacks around the world, noting the ransoms involved (in USD), whether or not they were paid, the number of records affected, and numerous other data points. We used this data alongside the monthly USD price of bitcoin (as noted by Yahoo Finance). Yahoo’s monthly data is based on the price of bitcoin on the 1st of the month, and we used the close price for that date.
To see all of the ransomware attacks and the data used for this comparison, please visit our worldwide ransomware tracker. And for a full list of sources for the ransomware attacks, please request access here.