USENIX researchers have identified 65,340 high-risk address instances across Ethereum and BNB Smart Chain networks, linking them to 126,982.94 ETH and 17,726.7 BNB in native-token losses. According to the study titled "Lost in Blockchain Address Misuse: Hidden Cross-Platform Risks and Their Security Impact," published at the 35th USENIX Security Symposium in Baltimore, the estimated losses are valued at more than $574.8 million using reference prices of $4,408 per ETH and $847 per BNB. The researchers extracted 16.3 million private keys from 63,004 GitHub repositories created between January 2015 and May 2025 for their cross-chain analysis dataset, using an April 2025 Stack Exchange archive for additional data.
The study divides address misuse into two primary categories. Contract Account misuse occurs when users treat addresses without deployed contract code as contracts, often due to contextual reuse across networks. Researchers identified 49,344 such instances associated with losses of 22,738.41 ETH and 8,681.41 BNB. Externally Owned Account misuse involves addresses with exposed or compromised private keys, with researchers identifying 15,996 EOA misuse instances associated with 104,244.53 ETH and 9,045.29 BNB in losses. More than 95% of EOA misuse losses came from the GitHub exposed-key subtype. The research team achieved 99.11% overall detection precision after manual sampling validation across both analyzed blockchain networks, with the precision figure representing detection accuracy rather than universal verification of all 65,340 instances.
The research uncovered two previously undescribed active attack vectors that together account for approximately $15.7 million in losses. The first exploits deterministic contract-address creation, allowing attackers to promote testnet contracts, wait for users to send mainnet funds to matching no-code addresses, and later deploy withdrawal code at the same location. Researchers linked 469 malicious contracts to losses of 3,446.37 ETH and 431.79 BNB. The second attack leverages EIP-7702 against accounts with exposed private keys, delegating EOAs to malicious code that automatically sweeps incoming funds. The detailed analysis identified more than 17,200 delegated addresses producing losses of 25.86 ETH and 33.45 BNB. Together, these two active vectors account for 3,472.23 ETH and 465.24 BNB in total losses, with the remaining aggregate covering the broader set of detected contract-account and exposed-key misuse cases.
The researchers highlighted the UniswapV2Router02 address 0xC532...4008 on Sepolia as a prominent case study, demonstrating how attackers exploit cross-chain address confusion. The address had approximately 158,775 transactions by August 2025, yet lacked contract code on the Ethereum mainnet. Despite this, 88 transactions were sent to it by users who mistakenly treated it as a contract. A malicious contract was deployed on the same address by an attacker on 6th October 2024, enabling the withdrawal of 3.78 ETH that users had inadvertently sent there. This case exemplifies how users can fall victim to address misuse even when contract code is absent on the mainnet.
The study reveals significant concentration of address misuse within specific GitHub repositories. GitHub-related cases alone included 21,160 BNB Chain addresses and 26,908 Ethereum addresses, associated with losses of 7,513.66 BNB and 19,229.40 ETH. The Truffle test address 0x627...3Ef57 serves as a prime example, whose publicly accessible private key enables attackers to instantly drain any money accidentally sent to it. Notably, over 85% of the addresses gathered from GitHub have not yet been misused, suggesting that the risk potential remains significant for dormant or compromised addresses. The researchers' detection system achieved 99.11% precision despite this high-risk concentration, indicating that continued user interaction with compromised addresses could substantially increase actual losses.
