Bitcoin’s price swings are so huge that even ransomware developers are dialling back their reliance on the currency, according to researchers at cybersecurity firm Proofpoint.

Over the last quarter of 2017, researchers saw a fall of 73% in payment demands denominated in bitcoin. When demanding money to unlock a victim’s data, cybercriminals are now more likely to simply ask for a figure in US dollars, or a local currency, than specify a sum of bitcoin.

Just like conventional salespeople, ransomware developers pay careful attention to the prices they charge. Some criminals offer discounts depending on the region the victim is in, offering cheaper unlocking to residents of developing nations, while others use an escalating price to encourage users to pay quickly and without overthinking things.

But a rapidly oscillating bitcoin price plays havoc with those goals, Proofpoint says. “Surging cryptocurrency values are a boon for holders of bitcoin. But they are a challenge for anyone who tries to price their product or service in bitcoin — threat actors included. In Q4, newer ransomware strains appeared to take this into account. Sigma ransomware first appeared in mid-November demanding a payment denominated in US dollars.”

Now, more than two thirds of ransomware strains seen in the wild denominate the payment in normal currencies. But they still demand the actual transaction be carried out in bitcoin, the researchers note.

“Denominating ransoms in a government-issued currency — even if the actual payment is made in the form of bitcoin — has two big benefits for an attacker. It allows the threat actors to maintain pricing stability and still accept their payments anonymously, and in a currency that, for the moment, continues to appreciate quickly.”

But with bitcoin prices now plummeting, from a high of over $19,000 in December to just over $11,000 today, there’s a chance the trend may reverse, Proofpoint notes. “No matter what happens, the correlation is more evidence of modern cybercriminals’ profit motive. They choose the tools and techniques that will best enable them to ‘follow the money.’”