Study finds 65,340 risky crypto addresses tied to $574 million in losses

A study presented at USENIX Security '26 identified 65,340 risky crypto addresses involved in misuse across Ethereum and BNB Smart Chain, with 126,982.94 ETH and 17,726.7 BNB in associated native-token losses.The researchers valued losses associated with those risky crypto addresses at more than $574.8 million. But the two newly described active attack vectors directly account for about $15.7 million, or 2.7%, of that figure. The full paper also used May 2025 reference prices of $4,408 per ETH and $847 per BNB, rather than each token's dollar value when the losses occurred.How risky crypto addresses become trapsThe study separates the problem into contract-account misuse and externally owned account misuse.Contract-account misuse occurs when someone sends a function call, sometimes with ETH or BNB attached, to an address that has no contract code on the selected network. The transaction can still succeed as a simple transfer without executing the intended function. Funds then sit at that address unless later-deployed code can move them.That enables the first active vector. An attacker can deploy a contract at a testnet address, wait for users to mistakenly send funds to the corresp...