Following the Money: Why Ransomware Groups Continue to Demand Bitcoin

When ransomware attacks make headlines, one detail almost always stands out: the attackers want to be paid in Bitcoin. Despite increased law enforcement efforts and advances in blockchain analytics, Bitcoin continues to be the cryptocurrency most commonly associated with ransomware operations. This raises an important question. If Bitcoin transactions can be traced, why do cybercriminals continue to rely on it?

The answer lies in a combination of convenience, accessibility, and a common misconception about how Bitcoin actually works.

Many people still believe Bitcoin is completely anonymous, but that is not the case. Bitcoin is better described as pseudonymous. Every transaction is permanently recorded on a public blockchain that anyone can inspect. What is hidden are the real identities behind the wallet addresses. At first glance, a transaction simply appears as funds moving from one alphanumeric address to another, with no obvious indication of who owns either wallet.

For ransomware operators, this level of privacy is often enough. Victims can purchase Bitcoin through major cryptocurrency exchanges with relative ease, allowing attackers to receive payments from virtually anywhere in the world without relying on traditional banking systems. Once a transaction has been confirmed, it cannot simply be reversed by a bank or payment processor, making Bitcoin an attractive option for extortion.

That said, receiving the ransom is only the beginning of the challenge for cybercriminals. Turning stolen cryptocurrency into usable money without revealing their identities is far more difficult than many people realize. Investigators now use sophisticated blockchain analysis tools to follow the movement of cryptocurrency across thousands of transactions. They can identify patterns, connect wallets to known criminal infrastructure, and often trace funds as they move through exchanges and other cryptocurrency services.

To slow investigators, ransomware groups typically move funds through numerous wallet addresses, convert Bitcoin into other cryptocurrencies, or use services designed to obscure transaction histories. These techniques make investigations more complex, but they do not make the money impossible to trace. Every movement of Bitcoin creates another permanent record on the blockchain, providing investigators with additional data that can be analyzed over time.

Several high-profile investigations have demonstrated that Bitcoin is far from invisible. In 2021, the U.S. Department of Justice recovered approximately $2.3 million in Bitcoin that had been paid to the attackers responsible for the Colonial Pipeline ransomware incident. A year later, authorities seized roughly $3.6 billion in Bitcoin connected to the 2016 Bitfinex cryptocurrency exchange hack. European law enforcement agencies have also recovered cryptocurrency linked to organized cybercriminal groups through coordinated international investigations. These cases highlight a simple reality: while tracing cryptocurrency can require significant technical expertise, it is often possible.

Even with these successful seizures, Bitcoin remains the preferred payment method for many ransomware groups. It is the largest and most widely recognized cryptocurrency, making it easier for victims to obtain than more privacy-focused alternatives. Criminals understand that victims under pressure are more likely to pay if the payment process is straightforward. From the attackers’ perspective, Bitcoin strikes a balance between widespread availability and a level of privacy that, while imperfect, is still useful.

Some ransomware groups have experimented with privacy coins such as Monero because they offer stronger protections against transaction analysis. However, these cryptocurrencies are less accessible, supported by fewer exchanges, and more difficult for victims to acquire quickly. As a result, Bitcoin continues to dominate the ransomware landscape despite its well-known limitations.

The belief that Bitcoin provides complete anonymity is becoming increasingly outdated. Every transaction leaves a permanent digital trail, and the tools available to investigators improve every year. While cryptocurrency has undoubtedly changed the economics of ransomware, it has also created a financial record that can ultimately become one of the most valuable sources of evidence in a cybercrime investigation. For ransomware operators, Bitcoin remains a useful tool, but it is no longer the invisible currency many once believed it to be.