Ransomware is a type of malicious software that locks or encrypts your files, then demands payment — usually in cryptocurrency — to restore access. Attackers use it to extort individuals, businesses, and even public institutions like hospitals.
Unlike traditional malware, ransomware doesn’t just spy, it takes your data hostage. Victims often see a pop-up or message demanding Bitcoin or another coin in exchange for a decryption key.
Ransomware has become one of the most profitable and fast-growing forms of cybercrime, thanks in part to the anonymity of the dark web and cryptocurrency payments.
Yes. Creating, spreading, or profiting from ransomware is a serious cybercrime. However, learning about ransomware or protecting against it is completely legal.
Disconnect from the internet, report the incident, and consult a cybersecurity expert. Avoid paying ransoms, there’s no guarantee you’ll regain access.
The dark web hosts many ransomware-as-a-service operations and marketplaces where attackers trade tools or stolen data.
Bitcoin, Monero, and Dash are common. Monero is especially popular because of its built-in privacy features.
A VPN prevents attackers from seeing your IP and encrypts data in transit. While it can’t remove malware, it helps reduce exposure and block surveillance efforts.
About the authors
Casey Ford, PhD
Communications Lead
Casey is the Head of Communications, lead writer, and editorial reviewer at Nym. He holds a PhD in Philosophy and researches the intersection of decentralized technologies and social life.
VPNs are great privacy tools, but you can still be tracked. Choose the right type of VPN to avoid it.
6 mins read
Popular cryptocurrencies used in ransomware
Cryptocurrency
Why Attackers Use It
Building a privacy-first defense stack
The best way to fight ransomware is to limit the amount of information available about you or your systems. Combine privacy tools for stronger defense:
Layer
Goal
Recommended Tool
Bitcoin (BTC)
The most widely recognized and accepted coin for payments, though transactions are traceable on-chain.
Monero (XMR)
Favored for true privacy; hides sender, receiver, and transaction amount by default.
Dash (DASH)
Offers optional privacy features through PrivateSend, making it harder to trace transactions.
Litecoin (LTC)
Popular for fast, low-fee transfers; often used for smaller ransom payments.
Zcash (ZEC)
Includes shielded transactions for stronger encryption and confidentiality.
Ethereum (ETH)
Sometimes used in decentralized ransom schemes, though less private by design.
Network encryption
Hide IP and traffic from attackers
NymVPN’s Anonymous mode
Browser protection
Block trackers and malicious ads
Private browsers like Brave
Data minimization
Remove exposed personal info
Remove personal data from web
Metadata privacy
Prevent network profiling
NymVPN
Decentralization
Reduce single points of failure
Decentralized data storage and VPNs
How ransomware spreads
Most ransomware infections start with human error: opening malicious attachments, downloading fake apps, or visiting compromised websites. Attackers also exploit software vulnerabilities and weak network configurations.
Here’s how a typical attack unfolds:
Phishing email or link delivers the malware.
Encryption begins silently in the background.
Files and systems lock up, often across entire networks.
A ransom note appears, demanding crypto payment.
Modern ransomware is sophisticated. Many gangs run “ransomware-as-a-service” operations on the dark web where they rent out malware kits and share profits with affiliates.
The dark web connection
The dark web plays a central role in the ransomware economy. It’s where stolen data is sold, exploits are traded, and ransomware groups recruit affiliates or advertise new tools.
Hidden marketplaces and encrypted communication channels make it easy for criminals to operate out of sight. Payments and negotiations often happen entirely within Tor-based forums or onion-addressed marketplaces, shielded from search engines and surface web monitoring.
Read more about dark web search engines and how attackers use anonymity tools to evade detection.
While law enforcement has made progress in shutting down some marketplaces, new ones appear constantly, illustrating how resilient and distributed the dark web ecosystem has become.
Why Cryptocurrency Is Used for Ransom Payments
Ransomware operators prefer cryptocurrency because it allows money to move across borders with fewer intermediaries. Payments can be made instantly, without banks or traditional identity checks, which makes it harder for investigators to follow the trail.
While Bitcoin was the earliest and most common choice, attackers now use a range of coins — some for privacy, others for speed or liquidity.
Today, most ransom demands include one or more of the following:
Some groups even provide “payment portals” hosted on Tor where victims can convert crypto or negotiate payments.
For individuals using cryptocurrency legitimately, privacy coins like Monero and Zcash demonstrate how cryptography can also protect consumers — not just criminals — when combined with privacy-respecting networks like NymVPN.
Privacy and ransomware: Prevention is the best defense
Ransomware thrives on exposure, both technical and personal. The more data about you is available online, the easier it becomes for attackers to target you or craft convincing phishing lures.
Using privacy tools reduces your digital footprint, cutting off the pathways attackers rely on:
VPNs encrypt your traffic and hide your IP from potential reconnaissance.
Private browsers like Brave and Firefox limit tracking and ads that could deliver malicious code.
Metadata protection prevents analysis of your behavior or patterns that might reveal vulnerabilities.
This doesn’t make you invincible, but it significantly reduces your exposure.
How to protect yourself from ransomware: Step-by-step
Keep systems updated: Regular software patches close security holes before attackers exploit them.
Back up your data: Store backups offline or in secure cloud storage, disconnected from your main network.
Always use NymVPN: It encrypts traffic and hides metadata, making it harder for attackers to trace or intercept connections.
Avoid suspicious links: Never open attachments from unknown senders.
Enable email filters: Many attacks begin through phishing emails that bypass simple spam detection.
Monitor for breaches: Tools like dark web monitoring can alert you to stolen credentials.
Use strong, unique passwords: Combine with two-factor authentication to protect logins even if data leaks.
If you suspect a ransomware attack, disconnect from the internet immediately, avoid paying the ransom, and contact cybersecurity professionals.
Together, these layers make it much harder for attackers to find, exploit, or extort you.
Ransomware and the privacy paradox
Ransomware shows how interconnected the internet has become: the same tools that enable privacy and free expression can also be abused for harm such as mass surveillance.
Encryption, Tor, and cryptocurrency are neutral technologies – it’s how people use them that defines the outcome.
For individuals, the goal should be to reclaim the benefits of these tools for defensive privacy, not criminal concealment.
With technology like NymVPN’s mixnet, users can enjoy encryption and anonymity while remaining on the right side of the law.
Ransomware and internet privacy
Dark web monitoring and ransomware tracking tools can help detect criminal activity, but privacy protection is what stops it from reaching you in the first place.
By combining NymVPN, private browsers, and encrypted communication tools, you can protect your data before attackers even try. Ransomware may be evolving, but so are privacy technologies — and Nym is building that future.
