A new study presented at USENIX Security ’26 has revealed a staggering $574.8 million in losses due to what researchers term “address misuse” across the Ethereum and BNB Smart Chain networks. The findings, detailed in the paper “Lost in Blockchain Address Misuse: Hidden Cross-Platform Risks and Their Security Impact,” underscore significant, previously underestimated vulnerabilities in how users and developers interact with blockchain addresses.
This extensive analysis identified 65,340 high-risk instances of address misuse, involving approximately 2.5 million transactions. The report shines a critical light on both technical shortcomings and user behavior patterns that have led to substantial financial drains within the decentralised finance (DeFi) ecosystem.
USENIX researchers uncover widespread crypto address misuse
The research, authored by Zhenzhe Shao and a team from multiple universities, presented its findings at the 35th USENIX Security Symposium in Baltimore. Their work systematically categorised address misuse into two primary types: Contract Account (CA) Misuse and Externally Owned Account (EOA) Misuse, exposing millions in drained funds.
The study found total losses of 17,726.7 Binance Coin (BNB) and 126,982.94 Ethereum (ETH). Calculated against May 2025 prices of $4,408 per ETH and $847 per BNB, this translates to the eye-watering sum of over $574.8 million.
Contract account misuse causes significant losses
A substantial portion of these losses stemmed from Contract Account (CA) misuse. Researchers attributed this category to 49,344 high-risk addresses and roughly 1.6 million transactions.
This particular form of misuse resulted in the loss of 22,738.41 ETH and 8,681.41 BNB. CA misuse typically happens when users mistakenly send assets to addresses they believe are smart contracts, but are, in fact, non-contract accounts or maliciously deployed contracts.
Externally owned account vulnerabilities exposed
Separately, the study identified 15,996 high-risk Externally Owned Account (EOA) addresses linked to approximately 910,000 transactions. These cases alone accounted for losses of 9,045.29 BNB and a massive 104,244.53 ETH.
The primary driver behind EOA misuse involves private keys that were inadvertently made public. When these keys are exposed, attackers can instantly drain any funds sent to the associated address, exploiting a fundamental security lapse.
GitHub’s unintended role in exposed data
The researchers delved into specific platforms to pinpoint where these vulnerabilities originated. GitHub, a popular code hosting platform, emerged as a significant source of exposed data contributing to address misuse. Cases linked to GitHub alone involved 21,160 BNB Chain addresses and 26,908 Ethereum addresses.
The study noted that these GitHub-related instances were associated with losses of 7,513.66 BNB and 19,229.40 ETH. For EOA misuse, GitHub-related cases alone accounted for 103,402.53 ETH and 8,521.07 BNB, stemming from publicly accessible private keys.
While over 85% of the addresses gathered from GitHub had not yet been exploited, the researchers’ detection system boasted a 99.11% precision rate. This indicates a lurking threat; should users continue to interact with these dormant or compromised addresses, the potential for future losses remains incredibly high.
Understanding the mechanisms of crypto address misuse
The USENIX study meticulously defined and investigated the two main categories of address misuse. Contract Account (CA) misuse, for instance, occurs when users mistakenly perceive an address that does not contain a smart contract as one. This often leads to funds being sent to an inaccessible address or one controlled by an attacker.
Externally Owned Account (EOA) misuse, on the other hand, is a more straightforward but equally destructive vulnerability. It stems from the exposure of an EOA’s private key, granting unauthorised individuals full control over the associated funds. The study noted that developers often expose these keys in public repositories or forums, making them easy targets.
Novel attack vectors identified
Beyond categorising existing issues, the research also unearthed a previously undocumented attack vector: deterministic contract address misuse. This sophisticated method exploits the predictable nature of address generation to manipulate contract interactions.
Attackers can deploy benign contracts on testnets and later strategically deploy malicious contracts at the identical addresses on mainnets. This allows them to effectively “trap” and then transfer funds that users inadvertently send to what they believe is a legitimate contract on the mainnet, highlighting a deep flaw in cross-chain development practices.
Real-world impact: the Sepolia case study
To illustrate the gravity of these findings, the researchers highlighted a specific case involving the UniswapV2Router02 address 0xC532…4008 on the Sepolia testnet. By August 2025, this address had accumulated approximately 158,775 transactions.
Critically, the equivalent address on the Ethereum mainnet lacked any contract code. Yet, 88 transactions were mistakenly sent to it by users. On October 6, 2024, an attacker exploited this by deploying a malicious contract at that very mainnet address, successfully withdrawing 3.78 ETH that users had inadvertently deposited there.
This incident vividly demonstrates how a lack of awareness or vigilance regarding address consistency across different networks can be weaponised. It’s a stark reminder that even seemingly minor discrepancies can have significant financial consequences in the immutable world of blockchain.
Broader implications for blockchain security and altcoins
The USENIX Security findings resonate deeply within the altcoin ecosystem, where new projects and smaller communities might be more susceptible to such vulnerabilities. The sheer volume of exposed addresses and transactions points to a systemic issue that goes beyond individual bad actors.
It suggests a critical need for enhanced security education for users and more robust development practices for projects. Developers must implement stricter controls over private key management and be acutely aware of how address deployment can be exploited across different network environments.
This isn’t an isolated problem either; an earlier AMBCrypto report detailed Ethereum-related address poisoning losses of around $62 million between late 2025 and early 2026. The consistent theme across these reports is that user vigilance and developer foresight are paramount.
The crypto industry, particularly the altcoin sector, must address these foundational security flaws to protect its participants and foster sustainable growth.