Ransom is collected in Bitcoin only because it's popular... but it's fully traceable, so needs to get money laundered. When possible, it's collected in XMR, which has a fully anonymous transfer mode.

Still...

Earlier this year, a guy I knew, came asking me for help, because he'd been "investing" in crypto, but suddenly one of the exchanges locked his funds for "suspicion of fraud". Turns out, the "investing" he was doing, came as a "trade secret" from a "cute lady" he met on Facebook, who taught him how to put in EUR into one web, exchange it for BTC, transfer those to another web, exchange them for USDT, then transfer those to an exchange and convert them back into EUR, all at a favourable rate, getting him something like 5% per day (that's a 5 billion % APR!). But, here's the catch: he was only allowed to do it only a day! So he patiently kept doing it for like a month, with small amounts like 500-1000 EUR each time... until suddenly, his last transfer got frozen. He contacted the (second) website, and they asked him for 1000 EUR to unfreeze the 1000 EUR in BTC he had there, pending to convert to USDT.

That's when he called me... and I told him "man, you've been had, you've been laundering money for who knows whom!"

A few days later, he managed to contact some more people in a similar situation, some guy with up 500K "locked up" like that, a car dealership owner, who sent the initial 1K unlocking fee... and a 10K legal fee... and a 25K certification fee... and was asking around whether he should send another 50K representation fee... all of that after having laundered who knows how many millions 🤦

Notice how they went from the BTC laundering, to a basic Nigerian scam with direct transfers, so full bank tracing that they'll have to launder later. I also knew another guy whose father fell for that scam... in the early 1990s! The simplest stuff has been doing the rounds for decades, even centuries, and it keeps working.