For years, the debate around cryptocurrency has largely focused on innovation, decentralisation, financial inclusion and freedom from traditional banking systems. Supporters argue that blockchain technology represents the future of finance and that regulation should encourage innovation rather than restrict it.
That conversation needs to change. Once cryptocurrency is viewed through the lenses of financial crime, consumer protection, national security and cyber resilience, the narrative shifts dramatically. What has been celebrated as a revolutionary financial innovation becomes arguably the single biggest enabler of cybercrime, giving cybercriminals the means to demand and receive payments across borders.
There’s no doubt that cryptocurrency has legitimate applications. Blockchain technology has enormous potential, and many businesses
However, you have to ask if criminals consistently demand payment in cryptocurrency because it provides the fastest, most practical and most difficult-to-recover means of transferring value across borders, shouldn’t that fact fundamentally change how we think about the technology?
The business model behind cybercrime
Modern ransomware has become one of the world’s fastest growing criminal industries, and South Africa is firmly on the radar of international cyber criminals. South Africa is the most targeted country in Africa for both ransomware and infostealer attacks, according to ESET’s Threat Report, with around 78% of South African companies experiencing a ransomware attack. Sophos’ 2025 South African ransomware survey found that 71% of organisations that experienced ransomware attacks paid the ransom, up from 43% the previous year.
The amounts paid aren’t small, either. The same Sophos research found that the average ransom payment in South Africa was R17.9 million, while the average cost of recovering from an attack, excluding the ransom itself, was R19.44 million. Globally, the figures are astronomical. In 2023, ransomware payments reached a record US$1.1 billion. Researchers estimate that publicly identified ransomware payments represent only part of the total picture. Academic research published in 2024 identified nearly US$700 million in previously unreported ransomware payments.
Despite the scale of the problem, there is very little that law enforcement can do because of the nature of cryptocurrency payments. In 2023, the FBI and international partners infiltrated the Hive ransomware group, providing decryption keys to more than 1300 victims and preventing an estimated US$130 million in ransom payments. When you consider that US$1.25 billion was paid globally to ransomware groups in cryptocurrency in 2023, this is a drop in the ocean.
The shift towards regulation
Governments are paying attention. They are no longer asking if crypto should be regulated, but rather how much regulation is necessary to balance innovation with financial crime, consumer protection and national security.
The European Union has introduced MiCA, one of the world’s most comprehensive crypto frameworks, requiring authorisation and supervision of crypto-asset providers while strengthening consumer protection and controls against money laundering and financial crime. Other major financial centres are following suit. The UK has strengthened AML requirements for crypto firms and is working internationally to combat ransomware, while Singapore has tightened licensing, AML and consumer protection requirements despite its strong pro-innovation stance. In the US, regulatory scrutiny of exchanges, stablecoins and AML controls has also intensified.
South Africa is following the same trajectory. Earlier this year, the National Treasury and the South African Reserve Bank published draft rules requiring many cross-border cryptocurrency transfers to pass through authorised crypto providers and be reported to the Financial Surveillance Department. This is supposed to reduce illicit financial flows and prevent crypto assets from being used to circumvent existing financial controls
Where regulation meets reality
The proposed South African regulations have received criticism from companies invested in the growth of cryptocurrency, like the CEO of crypto exchange VALR.
He believes that barring South African companies from moving crypto assets across the country’s borders will likely drive those transactions underground or offshore and reduce the very oversight National Treasury and the South African Reserve Bank are trying to achieve.
Criminals constantly evolve their methods, and exchanges and regulators face an incredibly difficult task. The debate shouldn’t be whether governments are overregulating cryptocurrency, but whether regulation has kept pace with the realities of modern cybercrime. Wallets capable of receiving ransom payments from cybercriminals exist within an ecosystem where compliance checks have apparently been completed and have passed Anti-Money Laundering (AML) checks.
Every ransomware attack relies on two separate crimes: A cyber-attack that compromises an organisation, and a financial system capable of receiving and moving the ransom. The first is a cybersecurity problem, but the second is increasingly a cryptocurrency problem. Until we address both sides of that equation, we will continue treating the symptoms of cybercrime while leaving one of its most powerful enablers largely intact.
