A study to be released at the USENIX Security '26 meeting showed that 65,340 high-risk addresses involving 126,982.94 original currency losses of ETH and 17,726.7 BNB were found on the premises of the Inn and BNB Smart Chain. The research team estimated the total amount at a single reference price to be over $574.8 million.

A study on site abuse and private key exposure covering two chains. The author emphasizes that this amount is not a historical bargain, but a uniform valuation of US$ 4,408 per ETH and US$ 847 per BNB, and is therefore more appropriate to be considered a consistent-calibre loss estimate. Since the statistical coverage includes only primary tokens in two chains, the ERP-20, NFT and other chain assets are not included.

Address abuse falls into two categories.

The study classified “place abuse” as misuse of contractual accounts and misuse of external accounts.

In this case, the misuse of a contractual account means that the user uses an address where the contract code has not been deployed as a contractual address, a situation that is often confused between addresses across chains or across networks. The study identified 49,344 relevant examples, with corresponding losses of 22,738.41 ETH and 8,681.41 BNB.

Misuse of an external account indicates primarily that the private key has been disclosed or that chain behaviour indicates an address where control may have been held by another person. The study identified 15,996 relevant examples of losses of 104,244.53 ETH and 9,045.29 BNB. According to the author, more than 95 per cent of this loss is related to the exposure of private keys on GitHub.

  • Misuse of contractual accounts: 49,344 examples
  • External account misuse: 15,996 examples
  • GitHub exposed private key is the main cause of EOA loss

GitHub Data is the main sample source

The research team extracted data from 63,004 GitHub warehouses created between January 2015 and May 2025, and collated 16.3 million private keys and 10.3 million candidate addresses. The team also conducted a cross-analysis of transactions at the Etherem Stack Exchange and Stack OverFlow, in conjunction with the public content of Etherem Stack Exchange and Stack OverFlow.

According to the paper, the overall accuracy of the test framework was 99.11 per cent after manual sampling. However, this figure does not mean that all 65,340 examples have been manually identified. The authors of the study also acknowledged that there is still a risk that there will still be errors in the inspirational identification method and that data coverage is incomplete.

Two new attack routes involve about $15.7 million.

The study also describes two new attack paths, involving a total of approximately $15.7 million.

One of these uses predictable contractual addresses. The attackers will pre-empt some of the locations where the contracts have not yet been deployed, and if the funds are misdirected by the users, the assets may be transferred directly.

The other category relates to EIP-7702. The assailants, against an external account that had leaked its private key, gave them the authority to give the malicious code to automatically consolidate the account upon receipt of funds. The paper found a total of 17,270 such cases, involving 25.86 ETH and 33.45 BNB.

It was also mentioned that another USENIX Security '26 paper found that over 63 per cent of the analysed EIP-7702 authorized transactions were related to malicious attacks against external accounts and identified 924 malicious contract accounts in seven chains supporting the mechanism.

Overall, the study looks more like a quantitative count of observed risks than a complete inventory of losses across the network. Based on the statistical calibration set by the author, it is now confirmed that the misuse of original currency addresses and the disclosure of private keys on both chains continue to expose security gaps.