The numbers say 65,340 risky crypto addresses. The numbers say $574.8 million in losses. The numbers also say two active attack vectors account for just $15.7 million—2.7% of the total. The math does not weep, it merely liquidates. The rest is noise, historical overcounting, and the echo of old keys left in public repositories.
A study presented at USENIX Security '26 dissected the landscape of address misuse on Ethereum and BNB Smart Chain. Researchers mined 63,004 GitHub repositories created between January 2015 and May 2025, extracting 16.3 million deduplicated private keys. They derived addresses, applied transaction-pattern rules, and ran lightweight symbolic execution. The result: 126,982.94 ETH and 17,726.7 BNB in native-token losses, valued at May 2025 reference prices of $4,408 per ETH and $847 per BNB. The headline figure is $574.8 million. But the active vectors—the ones that matter today—account for $15.7 million.
Let me be clear: I do not predict the future, I verify the past. And the past here is a dataset built on historical prices, not on-chain value at the time of loss. The researchers used a single snapshot price rather than matching each loss to its timestamp. That inflates the psychological impact. The real story is buried in the mechanics of two specific attack patterns.
The first vector: deterministic contract addressing. Contract-account misuse occurs when a user sends a function call to an address that has no contract code on the selected network. The transaction succeeds as a simple transfer. Funds sit inert. An attacker deploys a contract on a testnet at the same address, waits for the victim to send funds to the corresponding no-code mainnet address, then exploits deterministic deployment to place malicious code at that location. The code can then withdraw the trapped funds. The study identified 469 malicious contracts tied to 3,446.37 ETH and 431.79 BNB in losses. This is not a vulnerability in the protocol—it's a failure of user discipline. Based on my experience auditing 2017 ICO codes, I've seen this pattern before. Developers often reuse testnet addresses in production, or users blindly copy addresses from forums without verification. The code is not the enemy; the process is.
The second vector: EIP-7702 delegation. Externally owned account misuse starts with a public or otherwise exposed private key. Anyone can control the account. Automated sweepers race to remove incoming funds. EIP-7702 makes this drain more direct: an attacker uses the exposed key to delegate the account to malicious code that forwards a deposit to the attacker in the same transaction. The study found more than 17,200 delegated addresses and losses of 25.86 ETH plus 33.45 BNB. This is a new attack surface. EIP-7702 was designed to improve account abstraction, but it also introduces a delegation mechanism that, when combined with key leakage, becomes a one-click drain. The attackers are not sophisticated; they are sweepers. The vulnerability is not in the smart contract—it is in the key management habits of users who pushed private keys to public GitHub repositories.
Together, the two active vectors account for 3,472.23 ETH and 465.24 BNB. At current prices, that's roughly $15.7 million. The remaining $559 million comes from the broader set of detected contract-account and exposed-key misuse—addresses that were sent funds but never drained via these specific mechanisms. The study's precision is 99.11% for detection, but that does not mean all 65,340 addresses are actively exploitable. Many are dormant. Many hold funds that were long ago stolen by other means. The headline number is a scare tactic, not a risk assessment.
The contrarian angle: the real problem is not the active vectors—it is the data hygiene. The researchers mined 16.3 million unique private keys from GitHub. That is a staggering number. It means thousands of developers have committed private keys to public repositories. The two active vectors are merely the tip of the iceberg. The true risk is the persistent leakage of keys into public code, combined with the lack of wallet-level warnings. The researchers disclosed their findings to wallet developers and exchanges, but the paper does not provide a remediation rate. How many of those 65,340 addresses still hold funds? We don't know. Liquidity is not a promise, it is a state of flow—and in this case, the flow is toward the attackers.
Takeaway: The next six months will tell us whether wallet providers take action. The active vectors are small now, but they represent a reproducible pattern. The deterministic address vector can be mitigated by checking both the address and chain against official sources before sending transactions. The EIP-7702 vector requires wallet providers to warn users before delegating to unknown code. If these mitigations are not implemented, the $15.7 million figure will grow. The math does not weep, but it does warn. The data is clear. The question is whether the industry will listen.
