A study to be presented at USENIX Security '26 reveals that 65,340 high-risk address instances were identified on Ethereum and BNB Smart Chain, involving the loss of 126,982.94 ETH and 17,726.7 BNB in native tokens. The research team estimated the total value at over $574.8 million using a consistent reference price.
The study examines address abuse and private key exposure on two blockchains. The authors emphasize that this amount is not calculated based on historical transaction prices on a per-trade basis, but rather uses a uniform valuation of $4,408 per ETH and $847 per BNB, making it more appropriate as a consistently measured estimate of losses. Due to the scope of the analysis, only native tokens on these two chains are included; ERC-20 tokens, NFTs, and assets from other chains are not accounted for.
Address abuse is divided into two categories.
The study categorizes "address abuse" into two types: misuse of contract accounts and misuse of external accounts.
Among these, contract account misuse refers to users treating an address that has not deployed contract code as a contract address; this commonly occurs due to address confusion across chains or different network environments. The study identified 49,344 related instances, resulting in losses of 22,738.41 ETH and 8,681.41 BNB.
Misuse of external accounts primarily refers to addresses whose private keys have been exposed or whose on-chain behavior suggests that control may have been taken over by others. The study identified 15,996 related instances, corresponding to losses of 104,244.53 ETH and 9,045.29 BNB. The authors note that over 95% of these losses are associated with private keys exposed on GitHub.
- Contract account misuse: 49,344 instances
- Misuse of external accounts: 15,996 instances
- Exposure of private keys on GitHub is the primary cause of EOA losses.
GitHub data is the primary source of samples.
The research team extracted data from 63,004 GitHub repositories created between January 2015 and May 2025, compiling 16.3 million private keys and 10.3 million candidate addresses. The team also cross-analyzed transactions on Ethereum and BNB Smart Chain by incorporating public content from Ethereum Stack Exchange and Stack Overflow.
The paper states that, after manual sampling verification, the overall accuracy of the detection framework is 99.11%. However, this figure does not mean that all 65,340 instances were individually verified manually. The researchers also acknowledge that heuristic identification methods may still produce false positives and that data coverage is incomplete.
Two new attack paths involve approximately $15.7 million.
The study also describes two new attack vectors, totaling approximately $15.7 million.
One type exploits predictable contract addresses. Attackers pre-control certain addresses that have not yet deployed contracts; if users accidentally send funds to these addresses, the assets may be immediately stolen.
Another category is related to EIP-7702. Attackers target externally owned accounts with compromised private keys and authorize them to execute malicious code, enabling automatic fund aggregation once funds are received. The paper identified 17,270 such cases involving 25.86 ETH and 33.45 BNB.
The study also mentions that another USENIX Security '26 paper found that over 63% of analyzed EIP-7702 authorized transactions were associated with malicious attacks targeting externally owned accounts, and identified 924 malicious contract accounts spread across seven chains supporting this mechanism.
Overall, this study appears to be a quantitative statistical analysis of observed risks rather than a comprehensive inventory of total network losses. According to the authors’ defined metrics, it is currently confirmed that abuses of native token addresses and private key exposures continue to reveal security vulnerabilities on both chains.