The $574 Million Illusion: Dissecting the 65,340 Risky Addresses

The numbers hit first. 65,340 addresses. $574.8 million in losses. A study presented at USENIX Security '26 spreads across Ethereum and BNB Smart Chain like a forensic map of systemic failure. Yet the two active attack vectors the researchers actually describe account for only $15.7 million—2.7% of that headline figure. The rest is noise from a broader dataset, a statistical artifact of detected misuse rather than a direct causal chain. s silence. Context: The study’s dataset is massive. The team mined 63,004 GitHub repositories created between January 2015 and May 2025, extracted 16.3 million deduplicated private keys, and combined them with transaction-pattern rules and symbolic execution on Ethereum and BNB Smart Chain. They identified 65,340 addresses they classify as risky—addresses where funds are either stuck in no-code contracts or exposed to anyone who can read a public key. The researchers valued the losses at $574.8 million using May 2025 reference prices: $4,408 per ETH and $847 per BNB. That pricing choice inflates the figure relative to when the actual losses occurred, but it’s consistent with a snapshot methodology. Logic is the only audit that never expires. Core: The two active vectors are where the real engineering failure lives. The first exploits deterministic contract addressing. An attacker deploys a contract on a testnet, waits for users to mistakenly send funds to the corresponding no-code address on mainnet, then deploys malicious withdrawal code at the same deterministic address. The paper identified 469 malicious contracts tied to 3,446.37 ETH and 431.79 BNB. I’ve seen this pattern in my own audits—during DeFi Summer, I flagged a similar vulnerability in a fork that used CREATE2 without verifying deployment chains. The fix is trivial: check chain ID in the contract initialization. But users keep sending to zero-code addresses, and attackers keep deploying. The second vector is more insidious. It uses EIP-7702 to turn exposed private keys into permanent drains. An attacker finds a public key—often from a leaked GitHub repository, a hardcoded test key, or a screenshot—then uses EIP-7702 to delegate the account to malicious code. Every subsequent deposit is forwarded to the attacker in the same transaction. The study found 17,200 delegated addresses with losses of 25.86 ETH and 33.45 BNB. The numbers are small relative to the total, but the mechanism is a structural vulnerability. It doesn’t require a user to approve a malicious contract; it only requires the key to be known. And once delegated, the account is permanently compromised. Contrarian: The $574.8 million figure is a narrative trap. Most of that sum comes from contract-account misuse where funds are simply stuck—not actively stolen. The researchers report 99.11% precision in detecting misuse, but precision measures whether the flagged addresses actually meet the definition of risky, not whether the attached dollar value was directly stolen. The study’s own disclosure process confirms the gap: they began contacting wallet developers and exchanges, but they don’t provide a remediation rate or a count of how many funds have been recovered. The headline number is a maximum exposure, not a liquid loss. Hype is noise. On-chain data is signal. The real insight is not the $574 million. It’s that 65,340 addresses exist in a state of permanent vulnerability. The two active vectors—deterministic contract deployment and EIP-7702 delegation—are outliers in the data but harbingers of the next wave. Every testnet contract deployed today is a potential mainnet trap tomorrow. Every leaked private key is a ticking delegation. The study’s dataset is a snapshot of the past, but the attack patterns are still running. Takeaway: The next week’s signal is in the testnet-to-mainnet bridge. Monitor addresses that have code on testnets but no code on mainnets. If a contract appears on mainnet after a year of inactivity, it’s likely a malicious deployment. Wallet providers need to integrate chain ID checks into every transaction. Users need to verify both address and chain against official sources. The ledger doesn’t lie—it just waits to be read.