Crypto ‘address misuse’ drained $574.8M in ETH and BNB — USENIX study

In a current research titled “Misplaced in Blockchain Handle Misuse: Hidden Cross-Platform Dangers and Their Safety Affect,” revealed by USENIX Safety, researchers examined the difficulty of “Handle Misuse.”  

The researchers discovered 65,340 instances of high-risk deal with misuse by which roughly 2.5 million transactions had been concerned. The corresponding losses got here to 17,726.7 Binance [BNB] and 126,982.94 Ethereum [ETH].

The researchers calculated address-misuse losses to be price over $574.8 million. This, in reference to Might 2025’s costs of $4,408 per ETH and $847 per BNB.

On this, 49,344 high-risk addresses and roughly 1.6 million transactions had been the reason for Contract Account (CA) misuse. This led to losses of twenty-two,738.41 ETH and eight,681.41 BNB.

Moreover, instances involving GitHub alone included 21,160 BNB Chain addresses and 26,908 Ethereum addresses. They had been related to losses of seven,513.66 BNB and 19,229.40 ETH. 

Case research

The UniswapV2Router02 deal with 0xC532…4008 on Sepolia was highlighted by the researchers as having roughly 158,775 transactions by August 2025.

Regardless that the identical deal with lacked a contract code on the Ethereum mainnet, 88 transactions had been despatched to it by customers.

A malicious contract was deployed on the identical deal with by an attacker on sixth October 2024. 3.78 ETH that customers had inadvertently despatched there was withdrawn.

Losses incurred by EOA addresses

Concurrently, researchers discovered 15,996 high-risk Externally Owned Account (EOA) addresses related to roughly 910,000 transactions and losses of 9,045.29 BNB and 104,244.53 ETH.

Non-public keys that had been made public had been the first trigger of those losses. GitHub-related instances alone accounted for 103,402.53 ETH and eight,521.07 BNB.

For example, the Truffle take a look at deal with 0x627…3Ef57, whose publicly accessible personal key allows attackers to immediately drain any cash by accident despatched to it, was used.

Because it stands, over 85% of the addresses gathered from GitHub haven’t but been misused. Even so, the researchers’ detection system achieved 99.11% precision. This instructed that if customers proceed to work together with dormant or compromised addresses, the chance may improve.

This discovering was according to a current report by AMBCrypto. It revealed that Ethereum-related deal with poisoning losses totalled roughly $62 million between late 2025 and early 2026.

Last Abstract

• The Contract Account (CA) misuse led to losses of twenty-two,738.41 ETH and eight,681.41 BNB.
• In the meantime, Externally Owned Account (EOA) addresses misplaced 9,045.29 BNB and 104,244.53 ETH.