How Do Hackers Make Money? 10 Ways Cybercriminals Profit in 2026

Short answer: most hackers make money from ransomware and data extortion, business email compromise, crypto investment scams, and selling stolen passwords or network access to other criminals. The FBI’s 2025 Internet Crime Report counted $20.877 billion in reported losses, and the real total is higher.

Updated September 2026. We rewrote this guide with current examples and the FBI’s latest figures. The old version stopped around 2020 and missed the business models that now bring in most of the money: ransomware-as-a-service, business email compromise, crypto investment scams, infostealer markets and access brokers.

Most hacking today is a business. Criminal groups specialize, sell services to each other and reinvest in whatever pays best. One crew steals passwords, another buys them and breaks in, a third deploys ransomware, and someone else launders the proceeds.

The scale is large. The FBI 2025 Internet Crime Report counted 1,008,597 complaints and $20.877 billion in reported losses in 2025, up 26% from 2024. Those are only the losses people reported to the FBI, so the real total is higher.

How hackers make money: the 10 main ways

1. Ransomware-as-a-service and data extortion

Ransomware is still the best-known way hackers make money. Most big ransomware brands now run as ransomware-as-a-service (RaaS). The developers write the malware and run the leak site and payment portal. “Affiliates” break into victims and deploy it. The two sides split each ransom.

Attackers usually steal data before encrypting anything, then threaten to publish it if the victim refuses to pay. Some groups skip encryption and simply extort victims over stolen data.

• Chainalysis estimates ransomware groups received more than $820 million in on-chain payments in 2025, about 8% less than 2024, even though the number of claimed victims rose about 50% (Chainalysis).
• Verizon’s 2026 Data Breach Investigations Report found ransomware in 48% of breaches, but 69% of ransomware victims in its data didn’t pay. The median payment was $139,875 (Verizon DBIR).
• The FBI’s most-reported variants in 2025 were Akira, Qilin, INC/Lynx/Sinobi, BianLian and Play (FBI 2025 Internet Crime Report).

Fewer victims are paying, so gangs hit more targets and pile on pressure, such as threatening a company’s reputation or contacting its customers.

2. Business email compromise (BEC)

BEC is less dramatic than ransomware but often more profitable. The attacker takes over or spoofs a trusted email account, such as a CEO, supplier or real estate agent, and asks someone to pay an invoice or change bank details. Once the wire is sent, the money moves quickly through mule accounts.

The FBI received 24,768 BEC complaints in 2025 with $3.05 billion in reported losses, the second-highest loss category (FBI 2025 Internet Crime Report). Deepfakes make it harder to spot. In 2024, engineering firm Arup confirmed an employee in Hong Kong sent about $25 million after a video call with deepfaked “colleagues” (CNN).

The best defense is a process, not a gut feeling. Verify any payment change by calling a number you already have, and require two people to approve large transfers.

3. Crypto investment and pig-butchering scams

This is now the biggest money-maker in the FBI’s data. “Pig-butchering” scams start with a wrong-number text, a dating app match or a social media contact. Over weeks, the scammer builds trust and introduces a “can’t-lose” crypto trading platform. The victim sees fake profits, invests more, and then gets hit with made-up taxes and fees when trying to withdraw.

• Cryptocurrency investment fraud cost Americans $7.2 billion in 2025, the largest single source of reported losses. The FBI says these scams are largely run by organized groups in Southeast Asia that use trafficking victims as forced labor (FBI 2025 Internet Crime Report).
• In October 2025, the U.S. Justice Department charged the chairman of Cambodia’s Prince Group and filed to forfeit about 127,271 bitcoin, then worth roughly $15 billion, which it called its largest forfeiture action ever (DOJ).

4. Infostealers and stolen credential logs

Infostealers are cheap malware, often spread through fake software downloads, cracked games and malicious ads. They grab saved browser passwords, session cookies, crypto wallets and autofill data, then upload it as a “log.” Operators rent the malware by subscription and sell the logs in bulk on criminal markets and Telegram channels.

• Between March 16 and May 16, 2025, Microsoft identified more than 394,000 Windows computers infected with the Lumma infostealer before it helped disrupt the operation with the DOJ, Europol and others (Microsoft).
• In the 2024 Snowflake campaign, attackers logged in to customers’ cloud accounts with credentials stolen by infostealers, often from accounts without multi-factor authentication (Mandiant).

Stolen session cookies can bypass passwords and some MFA entirely, which is why they sell well.

5. Initial access brokers

Initial access brokers (IABs) break into company networks and sell that access instead of using it. Buyers are often ransomware affiliates who would rather pay for a foothold than find one.

Verizon’s 2026 DBIR looked at IAB offers and found 44% were for VPN access, followed by remote desktop tools. Most of the offers based on the ProxyShell and ProxyLogon Microsoft Exchange flaws appeared two to three years after those flaws were disclosed, which shows how long unpatched systems stay useful to criminals. Verizon also found that half of the ransomware victims with a prior infostealer or credential leak had that event within 95 days before the attack (Verizon DBIR). Chainalysis notes that spikes in payments to access brokers tend to come before ransomware activity rises.

6. Stealing, selling and ransoming data

Customer databases are valuable. Criminals sell them on dark web forums, use them for identity theft and phishing, or demand payment not to publish them. Personal data breaches were one of the FBI’s top complaint categories in 2025, with 67,456 complaints (FBI 2025 Internet Crime Report).

Recent campaigns show a shift toward cloud and software-as-a-service accounts. In 2025, a group Google tracks as UNC6040 phoned employees while pretending to be IT support and talked them into connecting a malicious app to their company’s Salesforce, then stole the data for extortion (Google Threat Intelligence). We cover more of these incidents in our phishing case studies.

7. Tech support, government and bank impersonation scams

These scams target individuals, especially older adults. A pop-up or call claims your computer is infected, your bank account is compromised or you owe the government money. The “fix” is remote access software, gift cards, a wire transfer, a crypto ATM or even a courier who collects cash or gold at your door.

In 2025, the FBI recorded $2.13 billion in tech and customer support scam losses and about $798 million in government impersonation losses. People over 60 reported about $7.7 billion in total losses (FBI 2025 Internet Crime Report). AI voice clones and fake videos are making these scams more convincing: the FBI logged 22,364 AI-related complaints with nearly $893 million in losses (FBI).

8. Cryptocurrency theft

Crypto exchanges, bridges and wallets hold large sums that can be moved in minutes. Chainalysis counted more than $3.4 billion in stolen crypto in 2025 (Chainalysis).

State-backed hackers are the biggest players. The FBI attributed the roughly $1.5 billion theft from the Bybit exchange in February 2025 to North Korea (FBI PSA), and Chainalysis estimates North Korean hackers stole $2.02 billion in 2025. North Korea also places IT workers under false identities in Western companies to earn salaries and, in some cases, extort their employers (FBI 2025 Internet Crime Report).

9. Card fraud and account takeover

Stolen card numbers still sell. Criminals get them from skimmers, compromised checkout pages (known as Magecart or web skimming attacks) and phishing. They test cards with small purchases, then use or resell them.

Account takeover works the same way with logins. Attackers reuse leaked passwords (credential stuffing) or impersonate a bank’s fraud team to get one-time codes, then drain the account or buy goods to resell. The FBI received about 4,700 account takeover complaints tied to bank-support impersonation in 2025, with $359.7 million in losses (FBI 2025 Internet Crime Report). Our guide to best password practices explains how unique passwords, passkeys and phishing-resistant MFA shut most of this down.

10. Crime-as-a-service: botnets, DDoS-for-hire and cryptojacking

Many hackers make money by selling tools rather than attacking victims themselves:

• Botnets of infected computers and routers are rented out to send spam, hide attack traffic as “residential proxies” or launch DDoS attacks.
• DDoS-for-hire (“booter” or “stresser”) sites sell attacks for a few dollars, and some gangs demand payment to stop an attack.
• Phishing kits and malware are sold by subscription, complete with customer support.
• Cryptojacking quietly uses a victim’s computers or cloud accounts to mine cryptocurrency. A stolen cloud key can run up a huge compute bill.

How hackers cash out

Stealing money is only half the job. Criminals move funds through money mules, mixers, cross-chain swaps and exchanges with weak identity checks, and they often convert crypto to cash through over-the-counter brokers. The FBI said cryptocurrency was involved in 181,565 complaints in 2025, with more than $11 billion in losses.

Speed matters for victims. The FBI’s Recovery Asset Team froze about $679 million of roughly $1.16 billion in attempted fraudulent transfers in 2025, a 58% success rate, mostly when victims reported quickly (FBI 2025 Internet Crime Report). If you’ve been scammed, contact your bank right away and report it at ic3.gov.

What this means for defenders

Almost every model above depends on a few weak points: stolen or reused credentials, unpatched internet-facing systems and people who can be pressured into acting fast. The controls that cut off the most revenue are:

• Phishing-resistant MFA (passkeys or security keys), especially for email, VPN and cloud admin accounts
• Fast patching of internet-facing systems, starting with CISA’s Known Exploited Vulnerabilities list
• Payment verification rules: a call-back to a known number and two-person approval
• Offline, tested backups and an incident response plan
• Training people to spot urgency, secrecy and payment changes. See what virtually all phishing emails have in common and our guide to social media security, where many scams start.

Some of these groups also go after hospitals, utilities and pipelines, where the damage goes well beyond money. Our guide to cyber attacks on critical infrastructure covers those cases, and our history of cybersecurity shows how the criminal economy grew out of early hobby hacking.

To keep up with new scams, ransomware campaigns and law enforcement takedowns, sign up for the CyberExperts Daily Brief.

Frequently asked questions

Sources

• FBI Internet Crime Complaint Center, 2025 Internet Crime Report: ic3.gov (PDF)
• FBI, Cryptocurrency and AI Scams Bilk Americans of Billions (April 6, 2026): fbi.gov
• Verizon, 2026 Data Breach Investigations Report: verizon.com
• Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report: chainalysis.com
• Chainalysis, 2025 crypto theft: chainalysis.com
• FBI PSA, North Korea Responsible for $1.5 Billion Bybit Hack (Feb 26, 2025): ic3.gov
• U.S. Department of Justice, Chairman of Prince Group Indicted (Oct 14, 2025): justice.gov
• Microsoft, Disrupting Lumma Stealer (May 21, 2025): blogs.microsoft.com
• Mandiant / Google Cloud, UNC5537 Targets Snowflake Customer Instances: cloud.google.com
• Google Threat Intelligence Group, The Cost of a Call: From Voice Phishing to Data Extortion: cloud.google.com
• CNN, Arup revealed as victim of $25 million deepfake scam (May 2024): cnn.com

Joseph Ochieng

Joseph Ochieng’was born and raised in Kisumu, Kenya. He studied civil engineering as first degree and later on pursued bachelors in information technology from the technical university of Kenya. His educational background has given him the broad base from which to approach topics such as cybersecurity, civil and structural engineering. When he is not reading or writing about the various loopholes in cyber defense, the he is probably doing structural design or watching la Casa de Papel . You can connect with Joseph via twitter @engodundo or email him via [email protected] for email about new article releases”