A new academic study has identified 65,340 high-risk address misuse cases on Ethereum and BNB Chain, linked to approximately $574.8 million in lost crypto. The research, led by teams from Sun Yat-sen University, Zhejiang University, and Peking University, details how testnet addresses, reused contract addresses, and exposed private keys lead to permanent losses. Attackers are also exploiting newer tools like EIP-7702 to control exposed accounts. The findings highlight that successful transactions can still result in lost funds when users interact with addresses that have no contract code on the intended network.
A new academic study has identified 65,340 high-risk address misuse cases on Ethereum and BNB Chain, linked to approximately $574.8 million in lost crypto. The research describes two forms of address misuse: Contract Account (CA) Misuse and Externally Owned Account (EOA) Misuse.
CA Misuse occurs when users treat a non-contract address as though a smart contract exists there. The researchers found 49,344 such cases, resulting in losses of about $50 million in ETH and $4.3 million in BNB.
One example involved a Uniswap V2 router address widely used on Ethereum’s Sepolia testnet. On Ethereum mainnet, the address had no contract code, yet users still sent function calls and ETH to it, leaving the funds trapped.
EOA Misuse accounted for 15,996 cases involving addresses whose private keys had been exposed, often through public code repositories. The study found losses of approximately $229 million in ETH and $4.5 million in BNB.
The researchers examined more than 10 million candidate addresses and 16 million exposed private keys, then analyzed about 2.5 million transactions. Manual checks gave the detection system an overall precision of 99.11%.
Attackers actively exploit these mistakes. In 469 CA misuse cases, attackers used cross-chain address reuse to place malicious contracts at addresses where users had already trapped funds, resulting in additional losses of about $7.6 million in ETH and $0.2 million in BNB.
Another 17,270 cases involved EIP-7702, which lets an externally owned account delegate execution to a smart contract. The researchers found attackers using the mechanism to control exposed accounts and automatically redirect incoming funds.
A separate report from Blockaid published on August 1 found $1.1 billion stolen across 212 incidents during the first half of 2026. The address misuse study points to a less obvious problem: a transaction can succeed while still producing a loss.
According to the researchers, people ought to check the network before using an address and rely on official project documentation while keeping test accounts away from production funds. They also called for wallets to warn users when an address has no contract code on the current chain or has a known exposed private key.
