A comprehensive academic study has traced nearly $574.8 million in cryptocurrency losses to errors involving Ethereum and BNB Chain addresses, highlighting major risks for users across both blockchains. The analysis uncovered 65,340 high-risk incidents, revealing that assets were often sent to incorrect or unsafe accounts, with transactions still being confirmed as successful.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLResearchers identify widespread contract misuse
A research team, including scholars from Sun Yat-sen, Zhejiang, and Peking universities, explored the underlying causes of these losses. The group focused on two main issues: Contract Account Misuse and Externally Owned Account Misuse. In their findings, contract account misuse arises when users assume that a contract exists at a familiar address. This assumption fails particularly when switching between networks, as an address containing code on one blockchain may not function as expected on another.
The study documented 49,344 cases of contract address misuse, resulting in the loss of 22,738.41 ETH and 8,681.41 BNB. Since most blockchain transactions receive confirmation even if the correct contract code is absent at the destination address, users are often unaware that their assets have been trapped or misdirected.
A notorious example involves the Uniswap V2 router address, which appeared on Ethereum’s Sepolia testnet but lacked contract code on Ethereum mainnet. Despite this, users continued to send function calls and ETH to the address, leaving their crypto inaccessible.
Attackers have exploited such incidents by deploying malicious contracts at addresses that were previously misused. In 469 analyzed cases, this cross-chain address reuse led to additional losses of 3,446.37 ETH and 431.79 BNB. This tactic enables criminals to capitalize on earlier user mistakes, converting them into active thefts.
Researchers identified thousands of cases where contract addresses, reused across blockchains, became targets for attackers. By launching malicious contracts at these addresses, bad actors intercepted funds from users who mistakenly believed they were interacting with a trusted smart contract.
Exposed keys and EIP-7702 expand user vulnerabilities
Externally owned account misuse has also played a significant role in documented losses. The study found 15,996 cases where exposed private keys, often published in code repositories, tutorials, or Q&A forums, allowed attackers to monitor and drain accounts immediately upon deposit.
These compromised accounts received 104,224.53 ETH and 9,045.29 BNB in total. The researchers analyzed more than 10 million potential addresses and 16 million exposed private keys, validating roughly 2.5 million transactions across Ethereum and BNB Chain. Their process achieved a 99.11% accuracy rate in detecting affected accounts.
Security risks have further increased following the introduction of EIP-7702, which permits externally owned accounts to delegate execution to smart contract code. This enabled attackers to take automatic control of compromised accounts and reroute future deposits without manual intervention. The team registered 17,270 such cases, where malicious delegation helped criminals control and drain exposed wallets.
These vulnerabilities continue to surface alongside broader blockchain security breaches. According to Blockaid, the first half of 2026 saw $1.1 billion stolen in 212 incidents, with single-day losses occasionally exceeding $35 million. Unlike prominent hacks, many Ethereum address errors appear as ordinary, confirmed transfers, making them harder to detect and address swiftly.
Emphasis on user education and proactive monitoring tools
The researchers emphasized that users should obtain wallet addresses strictly from official project documentation and keep test and production accounts separate. Enhanced wallet software and monitoring systems could also help. Specifically, wallets might be programmed to alert users when attempting to send funds to an address that lacks contract code on the detected chain or is known to be linked to exposed keys.
In a fast-moving crypto market, where a sudden altcoin listing or a Federal Reserve decision can shift the landscape within seconds, efficient and secure monitoring has become essential. Constantly switching between different applications for charts, news, and portfolio tracking can lead to costly mistakes for investors. As a result, more traders are adopting privacy-first solutions such as CryptoAppsy, which offers integrated real-time charts, smart price alerts, coin-specific news, and key macroeconomic data—without requiring account registration and all within a single interface.
The research suggests that thorough chain-specific checks and improved wallet alerts could significantly reduce the risk of irreversible losses from Ethereum address errors, urging users to proceed with caution before confirming critical transactions.
