A study presented at USENIX Security '26 identified 65,340 risky crypto addresses involved in misuse across Ethereum and BNB Smart Chain, with 126,982.94 ETH and 17,726.7 BNB in associated native-token losses.
The researchers valued losses associated with those risky crypto addresses at more than $574.8 million. But the two newly described active attack vectors directly account for about $15.7 million, or 2.7%, of that figure. The full paper also used May 2025 reference prices of $4,408 per ETH and $847 per BNB, rather than each token's dollar value when the losses occurred.
How risky crypto addresses become traps
The study separates the problem into contract-account misuse and externally owned account misuse.
Contract-account misuse occurs when someone sends a function call, sometimes with ETH or BNB attached, to an address that has no contract code on the selected network. The transaction can still succeed as a simple transfer without executing the intended function. Funds then sit at that address unless later-deployed code can move them.
That enables the first active vector. An attacker can deploy a contract at a testnet address, wait for users to mistakenly send funds to the corresponding no-code address on mainnet, then exploit deterministic contract addressing to deploy malicious withdrawal code at the same location. The paper identified 469 malicious contracts tied to 3,446.37 ETH and 431.79 BNB in losses.
