Study reveals 65,340 risky Ethereum addresses linked to $574.8M losses

A recent study presented by USENIX researchers at the 35th USENIX Security Symposium in Baltimore has identified 65,340 high-risk address instances across the Ethereum and BNB Smart Chain networks. These vulnerabilities are linked to an estimated loss exceeding $574.8 million, raising significant concerns for the wider cryptocurrency ecosystem.

The comprehensive research, detailed in a paper at USENIX Security ’26, quantifies these losses to include 126,982.94 ETH and 17,726.7 BNB in native tokens. This analysis provides a stark reminder of the persistent security challenges facing decentralized finance and blockchain technology.

Unpacking the Ethereum and BNB Chain vulnerabilities

The scale of the identified risk is considerable, encompassing 65,340 individual high-risk addresses. Researchers valued these token losses using reference prices of $4,408 per ETH and $847 per BNB, rather than the prices at the time of each transaction. They describe this total as a “conservative lower bound,” indicating that the actual losses could be higher.

This conservative estimate is due to the study’s focus solely on native ETH and BNB tokens within the two specified networks. It means the analysis might not capture all types of losses or those occurring on other blockchains, or even on ERC-20 and NFT assets within Ethereum itself.

Two main types of address misuse identified

The USENIX Security ’26 study categorizes these vulnerabilities into two primary forms of “Address Misuse.” Understanding these distinctions is crucial for users and developers working within the blockchain space.

Contract account misuse challenges

Contract Account (CA) misuse occurs when users inadvertently treat an address without deployed contract code as a functioning contract address. This often happens because the same address might be active in a different network context, leading to confusion and potential loss of funds.

The study pinpointed 49,344 such instances, contributing to substantial losses. These included 22,738.41 ETH and 8,681.41 BNB, demonstrating a significant attack surface in how contract interactions are perceived and managed.

Externally Owned Account risks

The second category, Externally Owned Account (EOA) misuse, points to situations where an address’s private keys are either exposed or show clear on-chain indicators of compromised control. This typically leads to direct theft, as attackers gain full access to funds.

Researchers documented 15,996 EOA misuse instances, resulting in the loss of 104,244.53 ETH and 9,045.29 BNB. Tellingly, more than 95% of these EOA misuse losses stemmed from private keys exposed in public GitHub repositories, underscoring poor security practices among some developers.

Emerging attack vectors and their impact

Beyond categorizing existing misuse, the study unearthed two previously less-documented, active attack vectors. These represent evolving threats that exploit specific nuances of blockchain architecture and user behavior.

Deterministic contract address exploits

One novel attack leverages the process of deterministic contract-address creation. Attackers can first promote a contract address on a testnet, encouraging users to send mainnet funds to that seemingly legitimate, but currently non-existent, mainnet address. Later, the attacker deploys malicious withdrawal code to the same mainnet address, sweeping up the mistakenly sent funds.

This sophisticated technique has already proven costly, with researchers linking 469 malicious contracts to losses of 3,446.37 ETH and 431.79 BNB. It highlights the need for extreme caution when interacting with addresses, even if they appear familiar from other network environments.

EIP-7702 delegation vulnerabilities

The second new attack vector exploits Ethereum Improvement Proposal (EIP)-7702 against accounts where private keys are already compromised. Attackers delegate control of these vulnerable Externally Owned Accounts to malicious code. This code then automatically sweeps any incoming funds, draining wallets in real-time.

The paper identified 17,270 such cases, leading to losses of 25.86 ETH and 33.45 BNB. Combined, these two newly described vectors account for roughly $15.7 million in losses at the researchers’ reference prices, signaling a concerning evolution in attacker tactics.

Rigorous methodology and acknowledged limitations

The research team employed a robust methodology to conduct their extensive analysis. They mined 63,004 GitHub repositories, ranging from January 2015 to May 2025, extracting an impressive 16.3 million deduplicated private keys. They also incorporated data from Ethereum Stack Exchange and Stack Overflow to build a comprehensive dataset.

After analyzing transactions on both Ethereum and BNB Smart Chain, the researchers reported an overall detection precision of 99.11% following manual sampling validation. This high precision underscores the effectiveness of their detection framework, which combines large-scale off-chain data mining with on-chain transaction and contract analysis.

However, the authors candidly acknowledge certain limitations within their study. They note the possibility of heuristic false positives and the inherent incompleteness of data. Furthermore, the headline loss calculations specifically exclude ERC-20 tokens, NFTs, and other blockchain networks, suggesting the total value of assets at risk across the broader crypto landscape is likely far greater.

Non-custodial payment platforms, while offering users greater control, still depend on robust address security.

Broader implications for blockchain security and user safety

The findings extend beyond the immediate financial losses, pointing to systemic security challenges within the blockchain ecosystem. The vulnerabilities associated with EIP-7702, in particular, are drawing increased scrutiny. Ethereum’s own official guidance warns against malicious EIP-7702 delegation, highlighting how hostile contract code could seize control of assets.

A separate USENIX Security ’26 study corroborated these concerns, finding that over 63% of analyzed EIP-7702 authorization transactions were linked to malicious EOA-targeted attacks. That study identified 924 malicious contract accounts across seven supported chains, painting a broader picture of this particular risk.

Past incidents also underscore the real-world impact of such vulnerabilities. For instance, EIP-7702 delegations were previously linked to automated wallet-draining activities following Ethereum’s Pectra upgrade. In a related development, attackers reportedly drained about $3.1 million from Polymarket users through phishing and malicious delegated execution, demonstrating the continuous need for enhanced crypto ETF offerings to consider underlying security risks.

The path forward: research and ecosystem evolution

In response to their findings, the researchers have put forth several key recommendations aimed at bolstering security. They advocate for wallet warnings whenever transactions involve known exposed keys or cross-chain contract mismatches. They also stress the importance of stronger secret management practices for developers and clearer address-to-network documentation for users.

Furthermore, they propose integrating chain identifiers into future contract-address derivation mechanisms, a technical refinement that could prevent some forms of misuse. It’s important to remember these are research recommendations; they don’t yet represent adopted protocol changes for Ethereum or BNB Chain.

Looking ahead, the research team plans to broaden their work to include additional blockchain networks and various token types. Until then, the reported totals of 126,982.94 ETH and 17,726.7 BNB should be understood as measured native-token losses within the specific scope of this study.

The $574.8 million figure serves as a standardized valuation estimate, reflecting the significant financial consequences of these pervasive security flaws.

This sustained focus on improving security is vital for the growth and stability of the entire digital asset market, especially as events like Bitcoin’s inflation impact continue to draw public attention to crypto as an asset class.