A new security study has identified tens of thousands of Ethereum and BNB Smart Chain addresses tied to risky activity, revealing how contract and key misuse have led to hundreds of millions in lost funds
Thousands of cryptocurrency users have lost access to funds after sending assets to risky blockchain addresses, according to a new academic study that mapped out how contract and key misuse on Ethereum and BNB Smart Chain can result in permanent losses. The research, presented at USENIX Security '26, identified 65,340 addresses involved in misuse, with losses valued at over $574 million based on May 2025 token prices.
How Address Misuse Happens
The study breaks down address misuse into two main categories: contract-account misuse and externally owned account (EOA) misuse. Contract-account misuse occurs when users send tokens or function calls to an address that lacks contract code on the intended network. In these cases, the transaction may succeed as a simple transfer, but the funds become trapped unless code is later deployed to move them. Attackers can exploit this by deploying contracts at testnet addresses, waiting for users to mistakenly send funds to the same address on mainnet, and then deploying malicious code to withdraw the assets. The researchers found 469 malicious contracts linked to losses of 3,446 ETH and 432 BNB through this method.
Private Key Exposure and Automated Drains
Externally owned account misuse typically starts with a leaked or exposed private key. Once a key is public, anyone can control the account, and automated bots often sweep incoming funds immediately. The study highlights a newer attack vector using EIP-7702, which allows an attacker to delegate an exposed account to malicious code that forwards deposits in a single transaction. This method was tied to over 17,200 delegated addresses and losses of nearly 26 ETH and 33 BNB. Together, the two active attack vectors directly accounted for about $15.7 million in losses, a small but significant portion of the total detected misuse.
Building the Dataset and Measuring Impact
To assemble their dataset, the research team analyzed 63,004 GitHub repositories created between January 2015 and May 2025, extracting more than 16.3 million deduplicated private keys. They combined direct key matches with transaction-pattern analysis and symbolic execution to identify risky addresses on Ethereum and BNB Smart Chain. The study reports a 99.11% precision rate for its address-misuse detection, based on independent review of sampled cases. However, the researchers note that the $574 million figure reflects losses calculated at May 2025 prices, not necessarily the value at the time of each incident.
Reducing User and Developer Risk
The authors have begun disclosing their findings to wallet developers, exchanges, and affected projects, but the paper does not specify how many addresses remain at risk or whether funds have been recovered. For users, the study recommends verifying both the address and blockchain network before sending funds. Developers are urged to keep test accounts and hardcoded keys out of production code, while wallet providers can help by warning users before transactions are sent to no-code or exposed-key addresses.
According to the study, the 65,340 risky addresses were linked to losses of 126,982.94 ETH and 17,726.7 BNB, valued at $574.8 million using May 2025 reference prices of $4,408 per ETH and $847 per BNB. The two newly described attack vectors accounted for about $15.7 million, or 2.7% of the total, with the remainder attributed to broader patterns of contract-account and key misuse. The research team's detection methods achieved a reported 99.11% precision rate, based on independent review of sampled cases.
Address misuse on public blockchains highlights the risks of sending funds to the wrong type of address or failing to secure private keys. Unlike traditional bank transfers, blockchain transactions are irreversible, and assets sent to inaccessible or compromised addresses are often lost permanently. As the ecosystem grows, both users and developers face increasing pressure to adopt better security practices and verification tools to reduce the risk of accidental or malicious fund loss.
