The $16.6 Billion
Shadow

Every day in 2024, the FBI's Internet Crime Complaint Center received more than 2,300 reports of cyber-enabled crime. By year's end, the total losses reported had reached $16.6 billion — a 33% increase from 2023, and a new record by a considerable margin. The report, released in April 2025, marks the 25th anniversary of IC3. In that time, the centre has received over nine million complaints. Four million of them came in the last five years alone.

The scale is staggering. But the official figures almost certainly represent only a fragment of reality. The FBI acknowledges this explicitly in its own report — ransomware losses, for example, are logged only when victims voluntarily report to IC3, excluding direct reports to FBI field offices and the vast majority of cases where companies quietly pay up or absorb losses internally to protect reputation. Chainalysis, which tracks ransom payments through blockchain analysis, estimates total ransomware payment flows at more than 60 times the FBI's reported figure. The $16.6 billion, in other words, is the floor, not the ceiling.

The anatomy of cybercrime has shifted. Phishing remains the highest-volume attack vector — 193,407 reports in 2024, more than double the next most common crime type. But it is investment fraud, not ransomware, that is now doing the most financial damage. Crypto-investment scams alone cost $5.8 billion, up 47% from 2023, driven by what the FBI calls "pig butchering" schemes — long-form social engineering operations in which victims are cultivated over weeks or months on messaging apps before being lured into fake investment platforms that drain their savings.

The victims skew older. Americans over 60 filed 147,127 complaints in 2024 — a 46% increase from 2023 — and suffered $4.9 billion in losses. The average loss per complaint for this group exceeded $83,000. FBI Director Kash Patel, in introducing the report, described the trend as "scammers stealing Americans' hard-earned savings." But the structural question is harder: in a world where cybercriminals are innovating faster than regulators can act, who is responsible for closing the gap?

Sources: FBI IC3 Annual Report 2024 (ic3.gov); Chainalysis Crypto Crime Report 2025; Coveware Q4 2024 Ransomware Report.

Ransomware presents a particular accounting problem. The FBI's reported ransomware loss figure — $12.5 million — is almost comically small given what the private sector data suggests. Chainalysis, which tracks on-chain payment flows, recorded approximately $813 million in ransomware payments in 2024 — a 35% decline from the record $1.1 billion paid in 2023, which Chainalysis attributes to a combination of law enforcement action (the disruption of LockBit in February 2024 was significant), increased victim resistance, and the growing influence of a no-pay norm in corporate incident response playbooks.

The decline in payments does not mean ransomware is in retreat. The number of IC3 ransomware complaints rose 9% in 2024. Researchers at Coveware note that with fewer victims paying, criminal groups have responded by increasing attack volume and targeting larger organisations more aggressively. The average initial ransom demand rose 78% between 2023 and 2024. The criminal calculus is straightforward: if the conversion rate is falling, you need more shots on goal.

Cryptocurrency's role in cybercrime has become structurally inseparable. Of the $16.6 billion in total reported losses, $9.3 billion — 56% — involved cryptocurrency. This represents a 66% increase from 2023, driven primarily by investment scams and money laundering infrastructure. The FBI's Recovery Asset Team froze $561 million in fraudulently obtained funds in 2024 using the Financial Fraud Kill Chain — a significant figure, but less than 4% of total reported losses.

The geographic concentration of complaints follows population: California, Texas, and Florida report the highest totals. But the most financially vulnerable victims are often the least likely to be in major urban centres. Elder fraud losses, which disproportionately affect retirees in areas with lower digital literacy and weaker formal support networks, now exceed total US motor vehicle theft losses by a factor of more than twelve.

Sources: FBI IC3 Annual Report 2024; Chainalysis Crypto Crime Report 2025 (Feb); Coveware Q4 2024 Ransomware Report.

The regulatory response to cybercrime remains fragmented. The US has no single federal cybercrime statute equivalent to GDPR — organisations are governed by a patchwork of sector-specific rules, state breach notification laws, and an FTC enforcement regime that moves considerably more slowly than criminal innovation. The SEC's 2023 cybersecurity disclosure rules — which require public companies to report material cyber incidents within four business days — represented a significant step, but apply only to listed companies and have already faced legal challenge from affected registrants.

In the EU, NIS2 (Network and Information Security Directive 2) entered force in October 2024, extending mandatory cybersecurity obligations to a broader range of sectors including healthcare, digital infrastructure, and food supply chains. The directive requires incident reporting within 24 hours of detection — a standard that most US companies would struggle to meet, given that the average detection-to-disclosure time for a data breach in 2024 was still measured in days, not hours.

The enforcement gap is stark. The FBI's Recovery Asset Team froze $561 million in 2024 — impressive operationally, but less than 4 cents in every dollar of reported losses. For the criminals operating from jurisdictions beyond US extradition reach — Russia, North Korea, China, and Iran account for the majority of attributable state-sponsored attacks — the risk calculus remains favourable.

Sources: FBI IC3 2024; SEC Cybersecurity Disclosure Rules (2023); EU NIS2 Directive; CISA 2024 Year in Review.