A USENIX Security ’26 study has identified 65,340 high-risk address instances across Ethereum and BNB Smart Chain, linking them to 126,982.94 ETH and 17,726.7 BNB in native-token losses.
Summary
- Researchers identified 65,340 high-risk address instances across Ethereum and BNB Chain in their large-scale study.
- Estimated losses reached 126,982.94 ETH and 17,726.7 BNB, valued by researchers above $574.8 million overall.
- Researchers extracted 16.3 million private keys from 63,004 GitHub repositories for their cross-chain analysis dataset.
- Their detection framework achieved 99.11% precision after manual sampling validation across both analyzed blockchain networks.
- Two newly described attack vectors exploited deterministic contract addresses and EIP-7702 delegated account control mechanisms.
The paper, presented at the 35th USENIX Security Symposium in Baltimore, estimates their dollar value at more than $574.8 million.
The dollar figure needs context. The researchers say they valued the token losses using reference prices of $4,408 per ETH and $847 per BNB rather than prices at the time of every transaction. They describe their findings as a “conservative lower bound” because the analysis covers only native ETH and BNB on the two networks and may miss less obvious cases.
Ethereum address misuse spans contract and private-key risks
The researchers divide “Address Misuse” into two categories. Contract Account misuse happens when users treat an address without deployed contract code as a contract address, often because the same address is used in another network context. The study identified 49,344 such instances, associated with losses of 22,738.41 ETH and 8,681.41 BNB.
Externally Owned Account misuse involves addresses whose private keys are exposed or show strong onchain signs of compromised control. Researchers identified 15,996 EOA misuse instances associated with 104,244.53 ETH and 9,045.29 BNB in losses. More than 95% of EOA misuse losses came from the GitHub exposed-key subtype.
Two new attack paths account for about $15.7M
The first newly described attack takes advantage of deterministic contract-address creation. Attackers can promote a contract address on a testnet, wait for users to mistakenly send mainnet funds to the matching no-code address, and later deploy withdrawal code at the same location. Researchers linked 469 malicious contracts to 3,446.37 ETH and 431.79 BNB in losses.
The second uses EIP-7702 against accounts with already exposed private keys. Attackers delegate those EOAs to malicious code that automatically sweeps incoming funds. The paper found 17,270 cases, producing losses of 25.86 ETH and 33.45 BNB. Using the paper’s reference prices, the two newly described vectors together account for roughly $15.7 million.
The 99.11% figure is precision, not universal verification
The team mined 63,004 GitHub repositories created between January 2015 and May 2025, extracting 10.3 million unique candidate addresses and 16.3 million private keys after deduplication. It also used Ethereum Stack Exchange and Stack Overflow data before analyzing transactions on Ethereum and BNB Smart Chain.
Researchers manually sampled results and reported 99.11% overall detection precision. That does not mean every one of the 65,340 instances was individually manually verified. The authors acknowledge possible heuristic false positives and incomplete data, while ERC-20, NFT and other chains are excluded from the headline loss calculation.
EIP-7702 security concerns are widening
Ethereum’s official guidance warns that malicious EIP-7702 delegation can give hostile contract code control over assets. A separate USENIX Security ’26 study found more than 63% of analyzed EIP-7702 authorization transactions were associated with malicious EOA-targeted attacks, identifying 924 malicious contract accounts across seven supported chains.
As previously reported, EIP-7702 delegations were linked to automated wallet-draining activity after Ethereum’s Pectra upgrade. In related coverage, attackers later drained about $3.1 million from Polymarket users through phishing and malicious delegated execution.
The authors recommend wallet warnings for known exposed keys and cross-chain contract mismatches, stronger secret management for developers and clearer address-to-network documentation. They also propose considering chain identifiers in future contract-address derivation. Those are research recommendations, not adopted Ethereum or BNB Chain protocol changes.
The researchers plan to expand future work to additional chains and token types. Until then, the 126,982.94 ETH and 17,726.7 BNB totals are best read as measured native-token losses within the study’s defined scope, while $574.8 million remains a standardized valuation estimate.
