Colonial Pipeline paid $4.4 million in Bitcoin to regain control of its systems. CNA reportedly paid $40 million.