Researchers presenting at USENIX Security ’26 identified 65,340 addresses across Ethereum and BNB Smart Chain involved in cryptocurrency misuse, with associated losses valued at more than $574.8 million.
The study analyzed GitHub repositories spanning January 2015 through May 2025, extracting 16.3 million deduplicated private keys from 63,004 repositories. Researchers also mined blockchain transaction data to identify addresses vulnerable to three distinct attack vectors: contract-account misuse, exposed private keys, and EIP-7702 delegation exploits.
Attack Vectors and Measured Losses
Contract-account misuse occurs when users send function calls to addresses with no contract code deployed, allowing funds to remain until later-deployed code moves them. Attackers can deploy contracts at testnet addresses, then exploit deterministic addressing to deploy malicious withdrawal code at corresponding mainnet locations.
Externally owned account misuse involves exposed private keys, where automated sweepers race to remove incoming funds. The researchers identified 469 malicious contracts and 17,200 delegated addresses across the two blockchains.
EIP-7702 enables attackers to delegate exposed accounts to malicious code that forwards deposits in the same transaction. Researchers detected losses of 25.86 ETH and 33.45 BNB from this vector alone.
Two active attack vectors directly accounted for $15.7 million in losses, or 2.7% of the total $574.8 million figure. The broader estimate reflects detected misuse beyond the two specifically described active attacks. Using May 2025 reference prices of $4,408 per ETH and $847 per BNB, researchers valued total native-token losses at 126,982.94 ETH and 17,726.7 BNB.
Detection and Disclosure
The study achieved 99.11% precision in address-misuse detection results. Researchers began disclosing findings to wallet developers and exchanges and attempted to contact affected projects.
Users can reduce risk by verifying addresses and chains against official sources. Developers should keep test accounts and hardcoded keys out of production code. Wallet providers can implement warnings before transactions reach no-code or exposed-key destinations.
