A peer-reviewed study accepted for presentation at USENIX Security '26 has documented 65,340 high-risk address instances across Ethereum and BNB Smart Chain. These addresses were tied to losses of 126,982.94 ETH and 17,726.7 BNB. Using May 2025 reference prices of $4,408 per ETH and $847 per BNB, the researchers placed the total value of associated losses above $574.8 million.

The paper, authored by Zhenzhe Shao of Sun Yat-sen University and Zhejiang University, analyzed more than 16.3 million deduplicated private keys extracted from 63,004 public GitHub repositories created between January 2015 and May 2025. An April 2025 Stack Exchange archive supplemented the data. The addresses participated in roughly 2.5 million transactions.

Breakdown of Misuse Categories

The researchers classified the high-risk instances into two main groups: 49,344 cases of contract-account misuse and 15,996 cases of externally owned account misuse. Contract-account misuse occurs when funds or function calls are sent to an address that lacks deployed code on the target network. The transaction can still complete as a simple transfer, leaving the assets at that address until later code is deployed.

Externally owned account misuse begins with a publicly exposed private key. Once the key is available, automated systems can monitor the address and sweep incoming funds. The study combined direct key matches with transaction-pattern analysis and lightweight symbolic execution to identify these cases. Validation showed 99.11 percent precision overall.

Two Newly Identified Attack Vectors

Beyond the broader corpus of misuse, the team detailed two previously undescribed active vectors that together accounted for approximately $15.7 million, or 2.7 percent of the full estimated losses.

The first vector exploits deterministic contract addressing. An attacker deploys a contract on a test network, waits for users to send funds to the matching no-code address on mainnet, then deploys malicious withdrawal code at the same deterministic location. The analysis identified 469 such malicious contracts linked to 3,446.37 ETH and 431.79 BNB in losses.

The second vector leverages EIP-7702, which allows an externally owned account to delegate execution to contract code. An attacker with an exposed key can set a malicious delegation that forwards a deposit in the same transaction. The detailed review found more than 17,200 delegated addresses associated with 25.86 ETH and 33.45 BNB in losses.

Combined, the two vectors produced 3,472.23 ETH and 465.24 BNB in quantified losses. The remainder of the $574.8 million figure covers the wider set of detected contract-account and exposed-key misuse rather than these two methods alone.

Root Causes and Detection Approach

The primary source of exposure was private keys hardcoded into projects and committed to public repositories. Developers often include keys for testing convenience and fail to remove them before publishing code. The volume of repositories and keys indicates the practice extends across hobbyist work and environments that may have been intended for production use.

Detection relied on heuristic rules, transaction-pattern matching, and symbolic execution. Researchers randomly sampled inferred cases, with two independent reviewers assessing whether each matched the study definitions. Addresses derived from public private keys were treated as confirmed.

Disclosure and Practical Steps

The authors reported beginning disclosure of findings to wallet developers and exchanges and attempting to reach affected projects. The paper does not include a full remediation rate or a current count of still-funded addresses among the 65,340 instances.

Users can lower risk by verifying both the destination address and the correct network against official sources before sending funds. Developers are advised to keep test accounts and hardcoded keys out of production repositories. Wallet providers can implement warnings for transactions directed at no-code addresses or destinations linked to previously exposed keys.

The quantified losses are limited to Ethereum and BNB Smart Chain. The study confined its measurements to what could be verified with high confidence on those networks.