Crypto ‘address misuse’ drained $574.8M in ETH and BNB — USENIX study
How do attackers target cryptocurrency users by taking advantage of cross-chain address confusion?
In a recent study titled “Lost in Blockchain Address Misuse: Hidden Cross-Platform Risks and Their Security Impact,” published by USENIX Security, researchers examined the issue of “Address Misuse.”
The researchers found 65,340 cases of high-risk address misuse in which approximately 2.5 million transactions were involved. The corresponding losses came to 17,726.7 Binance [BNB] and 126,982.94 Ethereum [ETH].
The researchers calculated address-misuse losses to be worth over $574.8 million. This, in reference to May 2025’s prices of $4,408 per ETH and $847 per BNB.
In this, 49,344 high-risk addresses and approximately 1.6 million transactions were the cause of Contract Account (CA) misuse. This led to losses of 22,738.41 ETH and 8,681.41 BNB.
Additionally, cases involving GitHub alone included 21,160 BNB Chain addresses and 26,908 Ethereum addresses. They were associated with losses of 7,513.66 BNB and 19,229.40 ETH.
Case study
The UniswapV2Router02 address 0xC532…4008 on Sepolia was highlighted by the researchers as having approximately 158,775 transactions by August 2025.
Even though the same address lacked a contract code on the Ethereum mainnet, 88 transactions were sent to it by users.
A malicious contract was deployed on the same address by an attacker on 6th October 2024. 3.78 ETH that users had inadvertently sent there was withdrawn.
Losses incurred by EOA addresses
Simultaneously, researchers found 15,996 high-risk Externally Owned Account (EOA) addresses associated with approximately 910,000 transactions and losses of 9,045.29 BNB and 104,244.53 ETH.
Private keys that were made public were the primary cause of these losses. GitHub-related cases alone accounted for 103,402.53 ETH and 8,521.07 BNB.
For instance, the Truffle test address 0x627…3Ef57, whose publicly accessible private key enables attackers to instantly drain any money accidentally sent to it, was used.
As it stands, over 85% of the addresses gathered from GitHub have not yet been misused. Even so, the researchers’ detection system achieved 99.11% precision. This suggested that if users continue to interact with dormant or compromised addresses, the risk could increase.
This finding was in line with a recent report by AMBCrypto. It revealed that Ethereum-related address poisoning losses totalled approximately $62 million between late 2025 and early 2026.
Final Summary
- The Contract Account (CA) misuse led to losses of 22,738.41 ETH and 8,681.41 BNB.
- Meanwhile, Externally Owned Account (EOA) addresses lost 9,045.29 BNB and 104,244.53 ETH.
