Study finds 65,340 risky crypto addresses tied to $574.8M

Researchers presenting at USENIX Security ’26 reported 65,340 crypto addresses on Ethereum and BNB Smart Chain that they classify as risky, and they linked those addresses to 126,982.94 ETH and 17,726.7 BNB. Using May 2025 reference prices of $4,408 per ETH and $847 per BNB, the paper values the aggregate native-token exposure at $574.8 million.

The study identifies two active attack vectors that together account for roughly $15.7 million of the total, about 2.7% of the paper’s broader dollar estimate. The first vector involves contract-account misuse: users send a function call or funds to an address with no deployed contract code on the target network. Transactions can succeed as simple transfers and the intended function does not run. The authors describe a pattern in which an attacker deploys a contract on a testnet address, waits for users to send funds to the corresponding no-code mainnet address, then deploys malicious withdrawal code at that same mainnet address. The team found 469 malicious contracts tied to losses of 3,446.37 ETH and 431.79 BNB from this pattern.

The second vector concerns externally owned account (EOA) misuse from exposed private keys. Public or leaked keys allow anyone to control the account, and automated sweepers often race to move incoming funds. The paper highlights an exploit that uses EIP-7702 delegation: an attacker who controls an exposed key can delegate the account to malicious contract code that forwards a deposit to the attacker within the same transaction. The researchers identified more than 17,200 delegated addresses and associated losses of 25.86 ETH and 33.45 BNB. Combined, the two active vectors account for 3,472.23 ETH and 465.24 BNB.

To build the dataset, the team mined 63,004 GitHub repositories created from January 2015 through May 2025 and used an April 2025 Stack Exchange archive. They extracted more than 16.3 million deduplicated private keys, derived corresponding addresses, and combined direct key matches with transaction-pattern rules and lightweight symbolic execution on Ethereum and BNB Smart Chain to infer misuse. The paper reports a 99.11% precision rate for the detection method, based on random sampling of inferred cases judged independently by two reviewers; addresses derived from public private keys were treated as confirmed.

The authors state they began disclosing findings to wallet developers and exchanges and attempted to contact affected projects. The paper does not provide a complete remediation rate or a current funded-address count for all 65,340 instances. The study includes a dataset and detection approach intended to help identify these categories of address misuse. Users are advised to verify destination addresses and target chains before sending funds, developers to avoid hardcoded keys and test accounts in production, and wallet providers to consider warnings when transactions target no-code or known exposed-key addresses.