USENIX study identifies 65,340 risky crypto addresses with $574.8M in losses
In brief
- USENIX Security study identified 65,340 risky addresses tied to $574.8M in losses on Ethereum and BNB Smart Chain.
- Two attack vectors—contract-account and EIP-7702 delegation misuse—directly account for $15.7M in losses.
- Researchers extracted 16.3M private keys from GitHub with 99.11% precision in detecting address misuse.
- Wallet providers and exchanges notified; users can reduce risk by verifying addresses against official sources.
Attack vectors and losses
The two active vectors differ sharply in execution. Contract-account misuse occurs when someone sends a function call to an address that has no contract code on the selected network. An attacker can deploy a contract at a testnet address and exploit deterministic contract addressing to deploy malicious withdrawal code at the same location on mainnet. The paper identified 469 malicious contracts tied to 3,446.37 ETH and 431.79 BNB in losses.
The second vector uses a different approach. Externally owned account misuse starts with a public or otherwise exposed private key. EIP-7702 makes account drains more direct by delegating the account to malicious code. The detailed analysis identified more than 17,200 delegated addresses and losses of 25.86 ETH plus 33.45 BNB.
Together, these two vectors account for 3,472.23 ETH and 465.24 BNB in direct losses.
Research methodology
The scope is substantial. Researchers mined 63,004 GitHub repositories created from January 2015 through May 2025 and extracted more than 16.3 million deduplicated private keys from GitHub. The researchers valued 126,982.94 ETH and 17,726.7 BNB in associated native-token losses using May 2025 reference prices of $4,408 per ETH and $847 per BNB. The authors reported 99.11% precision for their overall address-misuse detection results.
Disclosure and mitigation
The researchers didn't stop at analysis. They began disclosing findings to wallet developers and exchanges and tried to contact affected projects.
For end users, the defense is straightforward. Users can reduce immediate risk by checking both the address and chain against official sources. On the developer side, developers should keep test accounts and hardcoded keys out of production. Wallet providers can warn before transactions reach no-code or exposed-key destinations.
The scale of exposed keys and misused addresses underscores a persistent gap between developer practice and security reality. GitHub's public repositories remain a goldmine for attackers hunting hardcoded credentials.
