A study presented at USENIX Security, a peer-reviewed academic computer security conference, has documented more than $574.8 million in cryptocurrency losses attributable to address misuse on Ethereum and BNB Smart Chain.

By analyzing blockchain activity, the researchers examined how users interact with unsafe addresses. They identified 65,340 high-risk address instances tied to losses of approximately 126,983 ETH and 17,727 BNB. The study reports an overall detection precision of 99.11%.

How address misuse creates losses

The researchers classify address misuse into two main categories: Contract Account misuse and Externally Owned Account (EOA) misuse.

Contract Account misuse occurs when users mistakenly treat a non-contract address as a smart contract address. EOA misuse involves interactions with addresses whose private keys have been exposed. Both categories sit at the core of Ethereum's account model, in which contract accounts hold and execute code while EOAs are controlled by private keys — a distinction that is invisible in the raw address string itself. Ethereum and BNB Smart Chain are both EVM-compatible networks that share the same hexadecimal address format, meaning a valid-looking address conveys no indication of whether it holds code, who controls it, or how it will behave.

The study drew on roughly 10 million candidate addresses gathered from GitHub and Stack Exchange, together with about 16 million exposed private keys. Public code repositories and developer forums have repeatedly surfaced exposed credentials over the years, making them a recurring source for security research on leaked keys. Researchers then traced the related transactions on Ethereum and BNB Smart Chain.

Exposed addresses pose a major security threat

The researchers found that EOA misuse accounted for approximately 104,245 ETH and 9,045 BNB in losses. The findings indicate that users frequently interact with exposed addresses without realizing that those addresses may be controlled by attackers.

The study also identified previously undisclosed attack vectors. Attackers can exploit mistakes in address interactions to extract funds, turning seemingly ordinary blockchain activity into a theft opportunity.

Researchers warn of continuing risks

More than 85% of the collected addresses had not attracted misuse interactions at the time of the study. Even so, the researchers cautioned that those dormant addresses could still create risks if users interact with them incorrectly.

The findings point to a broader weakness in blockchain security: users often rely on addresses without fully understanding whether they represent legitimate contracts or whether their private keys remain secure. Ethereum's mixed-case checksum encoding (EIP-55) helps detect typing errors in an address, but it provides no signal about whether an address is legitimate or whether its key has been compromised.

The researchers argue that better address verification and stronger security awareness could reduce the risk. In practice, that points to checks users can already perform, such as confirming contract addresses against official project documentation and block explorers before transacting. Their results also show that blockchain address security extends beyond protecting private keys, requiring users to understand how addresses behave across different networks.