A new USENIX Security study has identified more than $574.8 million in cryptocurrency losses linked to address misuse across Ethereum and BNB Smart Chain.
The researchers analyzed blockchain activity to examine how users interact with unsafe addresses. They identified 65,340 high-risk address instances tied to about 126,983 ETH and 17,727 BNB in losses. The study reports an overall detection precision of 99.11%.
How address misuse creates losses
The researchers divide address misuse into two main categories: Contract Account misuse and Externally Owned Account misuse.
Contract Account misuse occurs when users mistakenly treat a non-contract address as a smart contract address. Externally Owned Account misuse involves interactions with addresses whose private keys have been exposed.
The study examined roughly 10 million candidate addresses gathered from GitHub and Stack Exchange, alongside about 16 million exposed private keys. Researchers then traced related transactions on Ethereum and BNB Smart Chain.
Exposed addresses pose a major security threat
The researchers found that EOA misuse accounted for about 104,245 ETH and 9,045 BNB in losses. The findings suggest that users frequently interact with exposed addresses without realizing that those addresses may be controlled by attackers.
The study also identified previously undisclosed attack vectors. Attackers can exploit mistakes in address interactions to extract funds, turning seemingly ordinary blockchain activity into a theft opportunity.
Researchers warn of continuing risks
More than 85% of the collected addresses had not attracted misuse interactions at the time of the study. However, the researchers said those dormant addresses could still create risks if users interact with them incorrectly.
The findings highlight a broader weakness in blockchain security. Users often rely on addresses without fully understanding whether those addresses represent legitimate contracts or whether their private keys remain secure.
The researchers argue that better address verification and stronger security awareness could reduce the risk. Their findings also show that blockchain address security extends beyond protecting private keys and requires users to understand how addresses behave across different networks.
