A study presented at USENIX Security ’26 identified 65,340 risky crypto addresses involved in misuse across Ethereum and BNB Smart Chain, with 126,982.94 ETH and 17,726.7 BNB in associated native-token losses.
The researchers valued losses associated with those risky crypto addresses at more than $574.8 million. But the two newly described active attack vectors directly account for about $15.7 million, or 2.7%, of that figure. The full paper also used May 2025 reference prices of $4,408 per ETH and $847 per BNB, rather than each token’s dollar value when the losses occurred.
How risky crypto addresses become traps
The study separates the problem into contract-account misuse and externally owned account misuse.
Contract-account misuse occurs when someone sends a function call, sometimes with ETH or BNB attached, to an address that has no contract code on the selected network. The transaction can still succeed as a simple transfer without executing the intended function. Funds then sit at that address unless later-deployed code can move them.
That enables the first active vector. An attacker can deploy a contract at a testnet address, wait for users to mistakenly send funds to the corresponding no-code address on mainnet, then exploit deterministic contract addressing to deploy malicious withdrawal code at the same location. The paper identified 469 malicious contracts tied to 3,446.37 ETH and 431.79 BNB in losses.
Externally owned account misuse starts with a public or otherwise exposed private key. Anyone who has the key can control the account, and automated sweepers can race to remove incoming funds.
The second vector uses EIP-7702 to make that drain more direct. An attacker can use the exposed key to delegate the account to malicious code that forwards a deposit to the attacker in the same transaction. The detailed analysis identified more than 17,200 delegated addresses and losses of 25.86 ETH plus 33.45 BNB.
Together, the two active vectors account for 3,472.23 ETH and 465.24 BNB. The rest of the paper’s aggregate covers the broader set of detected contract-account and exposed-key misuse rather than those two attacks alone.
To build the dataset, the team mined 63,004 GitHub repositories created from January 2015 through May 2025 and used an April 2025 Stack Exchange archive. It extracted more than 16.3 million deduplicated private keys from GitHub, derived their addresses and combined direct key matches with transaction-pattern rules and lightweight symbolic execution on Ethereum and BNB Smart Chain.
The authors reported 99.11% precision for their overall address-misuse detection results. They randomly sampled the inferred contract-account and pattern-based EOA cases, had two researchers independently judge whether each detection matched the study’s definitions, and separately treated addresses derived from public private keys as confirmed. The precision figure measures detection accuracy, not whether the full dollar estimate was directly caused by the two active vectors.
The researchers said they began disclosing the findings to wallet developers and exchanges and tried to contact affected projects. However, the paper does not provide a complete remediation rate or a current funded-address count for all 65,340 instances.
Users can reduce the immediate risk by checking both the address and chain against official sources. Developers should keep test accounts and hardcoded keys out of production, while wallet providers can warn before transactions reach no-code or exposed-key destinations.
