A recent study from USENIX Security ’26 has identified 65,340 high-risk addresses on the Ethereum and BNB Smart Chain networks. Total losses from these tens of thousands of addresses reached 126,982.94 ETH and 17,726.7 BNB, equivalent to $574.8 million based on a reference price of $4,408 per ETH and $847 per BNB.
The research team acknowledged that this $574.8 million figure is only a conservative lower estimate. The actual loss value is bound to be higher, as this calculation strictly records the theft of native network tokens. ERC-20 tokens or NFT collections swept from the victims’ wallets were not included in the calculation at all.
Hidden Dangers in Public Repositories
Researchers split these security gaps into two groups: contract account abuse and externally owned account (EOA) abuse. The contract account category accounted for 49,344 cases with losses of 22,738 ETH and 8,681 BNB. However, the heaviest financial blow hit the EOA group. Out of 15,996 addresses, funds totaling 104,244 ETH and 9,045 BNB vanished.
The facts regarding these EOA losses point to one primary source. More than 95% of the lost funds were not the result of complex network breaches, but rather a fundamental oversight: private keys exposed on GitHub.
To map the scale of this problem, the researchers mined 63,004 GitHub repositories created between January 2015 and May 2025. From that codebase stack, they extracted 10.3 million unique addresses and found 16.3 million private keys left exposed without security.
Two New Attack Vectors
In addition to human error, the research documents two previously unrecorded attack vectors. The first attack exploits a loophole in deterministic contract address generation. The pattern is straightforward: attackers promote a contract on a testnet, and then they only need to wait for real funds from the mainnet to be misdirected to the same address.
The second attack involves the EIP-7702 standard, targeting accounts with already leaked private keys. Attackers exploit the functionality of this upgrade to program automated sweeping. As soon as funds enter the victim’s wallet, the hacker’s system instantly sweeps them. Researchers recorded 17,270 cases using this method. The situation is further complicated after a separate study presented at the same USENIX Security ’26 event confirmed that more than 63% of EIP-7702 authorization transactions were indeed linked to malicious attacks.
Prevention Starting from Crypto Wallets
The detection system used in this research is claimed to have a precision of 99.11%, although the research team admitted they did not manually verify all 65,340 addresses one by one.
As a preventive measure, researchers urge crypto wallet developers to integrate early warning systems. Users must receive notifications when their keys are detected in repositories. On the technical side, developers are required to implement stricter cryptographic secrets management and include network-specific identification when designing contract address derivation in the future.
As reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
