Security study links 65,340 crypto addresses to $574.8 million in losses

The analysis categorized these security failures into two primary vectors: contract account misuse and compromised externally owned accounts (EOA). Contract account incidents occurred when users erroneously sent funds to addresses lacking deployed code, resulting in over 31,000 combined ETH and BNB losses. Meanwhile, EOA compromises, largely driven by exposed private keys on public repositories, accounted for the bulk of the financial damage.

Two specific attack methods highlighted in the paper demonstrate how evolving blockchain standards are being weaponized. By exploiting deterministic contract creation, attackers bait users into sending mainnet funds to no-code addresses before deploying withdrawal mechanisms. Additionally, researchers identified 17,270 cases where EIP-7702 delegations were used to grant malicious contracts automated control over assets already tied to exposed keys. These two vectors alone represent approximately $15.7 million in losses.

To build their dataset, the team processed 63,004 GitHub repositories spanning a decade of development. While the study reports a 99.11% precision rate for their detection framework, the authors characterize the $574.8 million figure as a conservative lower bound. Because the scope excludes ERC-20 tokens and NFTs, the actual financial impact on these ecosystems likely exceeds the reported total. The researchers suggest that integrating chain identifiers into address derivation and implementing stricter wallet-level warnings for exposed keys could mitigate these recurring risks, though no protocol-level changes have yet been adopted.