USENIX Study Reveals 65,340 Risky Crypto Addresses Linked to $574M in Losses

Woofun AI reports that a comprehensive analysis presented at USENIX Security '26 has quantified the scale of address misuse across major blockchains, identifying 65,340 risky crypto addresses on Ethereum and BNB Smart Chain associated with $574 million in losses. This investigation isolates two primary failure modes: contract-account misuse and externally owned account misuse, revealing how structural vulnerabilities in address deployment and key management facilitate significant asset drainage.

The mechanics of contract-account misuse exploit the distinction between code execution and simple value transfer. When a user sends a function call to an address that currently holds no contract code on the selected network, the transaction often succeeds as a simple transfer rather than failing or executing intended logic. These funds remain stranded at the address until code is deployed. Attackers leverage deterministic contract addressing to execute a specific vector: they deploy a contract at a testnet address, wait for users to mistakenly send funds to the corresponding no-code address on mainnet, and then deploy malicious withdrawal code at that same location to claim the assets.

Quantifying the impact of this contract-based vector, the study identified 469 malicious contracts directly tied to these exploits. The financial toll from this specific mechanism amounted to 3,446.37 ETH and 431.79 BNB in losses. These figures represent only the subset of contract-account misuse where attackers successfully deployed code to drain funds, highlighting the precision of this attack vector despite its reliance on user error in address verification.

Externally owned account misuse stems from the exposure of private keys, either through public repositories or other security lapses. Once a key is exposed, anyone possessing it can control the account, allowing automated sweepers to race to remove incoming funds before the legitimate owner can react. A more sophisticated vector utilizes EIP-7702 to streamline this drainage. An attacker can use the exposed key to delegate the account to malicious code that forwards a deposit to the attacker in the same transaction, effectively bypassing traditional sweeping delays.

Woofun AI data shows that this EIP-7702 exploitation resulted in 17,200 delegated addresses being compromised, with direct losses of 25.86 ETH and 33.45 BNB. When combining both active vectors—the contract deployment exploits and the EIP-7702 delegations—the total loss reached 3,472.23 ETH and 465.24 BNB.

However, the broader aggregate of detected misuse, which includes all identified contract-account and exposed-key instances rather than just these two active attacks, totals 126,982.94 ETH and 17,726.7 BNB, illustrating the vast difference between active exploitation and passive risk exposure.

To construct this dataset, researchers mined 63,004 GitHub repositories created from January 2015 through May 2025 and utilized an April 2025 Stack Exchange archive. They extracted more than 16.3 million deduplicated private keys from GitHub, derived their addresses, and combined direct key matches with transaction-pattern rules and lightweight symbolic execution on Ethereum and BNB Smart Chain. The authors reported 99.11% precision for their overall address-misuse detection results. This high precision was validated by having two researchers independently judge whether each detection matched the study's definitions, while separately treating addresses derived from public private keys as confirmed cases.

The researchers initiated disclosure to wallet developers, exchanges, and affected projects, though the paper does not provide a complete remediation rate or a current funded-address count for all 65,340 instances. Users can mitigate immediate risk by verifying both the address and chain against official sources. Developers must keep test accounts and hardcoded keys out of production, while wallet providers should implement warnings before transactions reach no-code or exposed-key destinations.