The data is unambiguous. A study presented at USENIX Security ’26 identified 65,340 risky crypto addresses across Ethereum and BNB Smart Chain. The associated native-token losses: 126,982.94 ETH and 17,726.7 BNB. At May 2025 reference prices of $4,408 per ETH and $847 per BNB, that totals more than $574.8 million. But the numbers alone do not tell the story. The two newly described active attack vectors directly account for only $15.7 million—2.7% of that figure. The rest is a graveyard of user error, forgotten keys, and structural misuse.
Context: What the Study Actually Found
The research team mined 63,004 GitHub repositories from January 2015 through May 2025, plus an April 2025 Stack Exchange archive. They extracted over 16.3 million deduplicated private keys from GitHub, derived addresses, and combined direct key matches with transaction-pattern rules and lightweight symbolic execution. The result: 65,340 addresses flagged as “risky” across two categories—contract-account misuse and externally owned account (EOA) misuse. The precision for the overall detection was 99.11%, meaning false positives are minimal. Yet the paper’s $574.8 million figure is a gross estimate of all funds associated with those addresses, not a direct attribution to the two active attack vectors.
Core: The Two Active Vectors That Demand Attention
Vector 1: Deterministic Contract Deployment Poisoning
Contract-account misuse occurs when a user sends a function call—sometimes with ETH or BNB attached—to an address that has no contract code on the selected network. The transaction succeeds as a simple transfer, but the intended logic never executes. Funds sit at that address, recoverable only if code is deployed later.
An attacker exploits this by deploying a contract on a testnet at a specific address, then waits for users to mistakenly send funds to the corresponding no-code address on mainnet. Because contract addresses are deterministic (via CREATE2 or the sender’s nonce), the attacker can later deploy malicious withdrawal code at the same location on mainnet, siphoning the trapped funds. The study identified 469 malicious contracts tied to 3,446.37 ETH and 431.79 BNB in losses.
In my own audit experience, I have seen development teams accidentally commit testnet addresses to production configurations. This vector weaponizes that oversight. The attack is not theoretical—it is a clock ticking on every unclaimed testnet address that shares a deterministic path with a mainnet counterpart.
Vector 2: EIP-7702 Delegation Drains
EOA misuse starts with a public or exposed private key. Anyone with the key can control the account, and automated sweepers race to remove incoming funds. The second vector uses EIP-7702 to make that drain more direct. An attacker uses the exposed key to delegate the account to malicious code that forwards any deposit to the attacker in the same transaction. The study identified over 17,200 delegated addresses and losses of 25.86 ETH plus 33.45 BNB.
Together, the two active vectors account for 3,472.23 ETH and 465.24 BNB. That is $15.7 million at May 2025 prices. The rest of the aggregate covers broader misuse: funds stuck at no-code addresses, keys leaked in GitHub repos, and contracts that were never meant to hold value.
Contrarian: The 2.7% Blind Spot
The $574.8 million headline is dramatic, but it obscures a more important truth. The two active vectors represent only 2.7% of the total loss estimate. The remaining 97.3% is passive misuse—funds that are lost, not stolen. Users sent ETH to addresses that never had code. Private keys were uploaded to public repositories. The crypto community focuses on active exploits, but the silent hemorrhage of user error is far larger.
Furthermore, the precision of 99.11% refers to detection accuracy, not loss attribution. The researchers used May 2025 reference prices rather than the dollar value at the time of each loss. If the losses occurred in 2021 or 2022, the actual dollar impact is significantly different. The study also does not provide a complete remediation rate or a current funded-address count for all 65,340 instances. Disclosure to wallet developers and exchanges began, but the paper does not claim full mitigation.
Stress tests reveal the fractures before the flood. This study is a stress test of the entire address management paradigm. The fractures are not in the code alone—they are in the user behavior and the lack of guardrails.
Takeaway: The Ledger Remembers What the Market Forgets
The 65,340 addresses are a permanent record of systemic fragility. The immediate fix is user education: check both the address and chain against official sources. Developers must keep test accounts and hardcoded keys out of production. Wallet providers should warn before transactions reach no-code or exposed-key destinations.
But the deeper issue is structural. Blockchain’s immutability punishes mistakes without recourse. Formal verification of address usage patterns could prevent these traps. The next generation of smart wallets must incorporate runtime checks for destination code existence and key exposure.
