65,340 Risky Crypto Addresses Tied to $574 Million in Losses

A study published in USENIX Security '26 has identified 65,340 risky cryptocurrency addresses tied to $574.8 million in losses across Ethereum and BNB Smart Chain.

The researchers found that these addresses were involved in misuse, with losses of 126,982.94 ETH and 17,726.7 BNB. The study valued the total losses at more than $574.8 million, but noted that two newly described active attack vectors accounted for only about 2.7% of this figure, totaling around $15.7 million.

The researchers identified two main types of misuse: contract-account misuse and externally owned account misuse. Contract-account misuse occurs when someone sends a function call to an address with no contract code on the selected network, allowing funds to sit at that address until later-deployed code can move them. Externally owned account misuse starts with a public or exposed private key, enabling anyone with the key to control the account.

The study found that 469 malicious contracts were tied to $ETH and BNB losses of 3,446.37 ETH and 431.79 BNB. The researchers also identified over 17,200 delegated addresses and losses of 25.86 ETH plus 33.45 BNB using EIP-7702.

To build the dataset, the team mined 63,004 GitHub repositories created from January 2015 through May 2025 and used an April 2025 Stack Exchange archive to extract more than 16.3 million deduplicated private keys from GitHub.