Study finds 65,340 risky crypto addresses tied to $574 million in losses
A research introduced at USENIX Security ’26 recognized 65,340 risky crypto addresses concerned in misuse throughout Ethereum and BNB Smart Chain, with 126,982.94 ETH and 17,726.7 BNB in related native-token losses.
The researchers valued losses related to these risky crypto addresses at greater than $574.8 million. But the 2 newly described lively assault vectors immediately account for about $15.7 million, or 2.7%, of that determine. The full paper additionally used May 2025 reference costs of $4,408 per ETH and $847 per BNB, relatively than every token’s greenback worth when the losses occurred.
How risky crypto addresses develop into traps
The research separates the issue into contract-account misuse and externally owned account misuse.
Contract-account misuse happens when somebody sends a operate name, generally with ETH or BNB hooked up, to an handle that has no contract code on the chosen community. The transaction can nonetheless succeed as a easy switch with out executing the meant operate. Funds then sit at that handle until later-deployed code can transfer them.
That permits the primary lively vector. An attacker can deploy a contract at a testnet handle, look forward to customers to mistakenly ship funds to the corresponding no-code handle on mainnet, then exploit deterministic contract addressing to deploy malicious withdrawal code on the identical location. The paper recognized 469 malicious contracts tied to 3,446.37 ETH and 431.79 BNB in losses.
Externally owned account misuse begins with a public or in any other case uncovered personal key. Anyone who has the important thing can management the account, and automatic sweepers can race to take away incoming funds.
The second vector makes use of EIP-7702 to make that drain extra direct. An attacker can use the uncovered key to delegate the account to malicious code that forwards a deposit to the attacker in the identical transaction. The detailed evaluation recognized greater than 17,200 delegated addresses and losses of 25.86 ETH plus 33.45 BNB.
Together, the 2 lively vectors account for 3,472.23 ETH and 465.24 BNB. The remainder of the paper’s combination covers the broader set of detected contract-account and exposed-key misuse relatively than these two assaults alone.
To construct the dataset, the workforce mined 63,004 GitHub repositories created from January 2015 by means of May 2025 and used an April 2025 Stack Exchange archive. It extracted greater than 16.3 million deduplicated personal keys from GitHub, derived their addresses and mixed direct key matches with transaction-pattern guidelines and light-weight symbolic execution on Ethereum and BNB Smart Chain.
The authors reported 99.11% precision for his or her total address-misuse detection outcomes. They randomly sampled the inferred contract-account and pattern-based EOA instances, had two researchers independently decide whether or not every detection matched the research’s definitions, and individually handled addresses derived from public personal keys as confirmed. The precision determine measures detection accuracy, not whether or not the complete greenback estimate was immediately attributable to the 2 lively vectors.
The researchers mentioned they started disclosing the findings to pockets builders and exchanges and tried to contact affected initiatives. However, the paper doesn’t present an entire remediation charge or a present funded-address rely for all 65,340 situations.
Users can cut back the instant threat by checking each the handle and chain towards official sources. Developers ought to preserve take a look at accounts and hardcoded keys out of manufacturing, whereas pockets suppliers can warn earlier than transactions attain no-code or exposed-key locations.
The submit Study finds 65,340 risky crypto addresses tied to $574 million in losses appeared first on CryptoSlate.
