65,340 Risky Crypto Addresses Linked to $574M Losses

The second vector uses EIP-7702 to make that drain more direct. An attacker can use the exposed key to delegate the account to malicious code that forwards a deposit to the attacker in the same transaction. The detailed analysis identified more than 17,200 delegated addresses and losses of 25.86 ETH plus 33.45 BNB.

Together, the two active vectors account for 3,472.23 ETH and 465.24 BNB. The rest of the paper's aggregate covers the broader set of detected contract-account and exposed-key misuse rather than those two attacks alone.

To build the dataset, the team mined 63,004 GitHub repositories created from January 2015 through May 2025 and used an April 2025 Stack Exchange archive. It extracted more than 16.3 million deduplicated private keys from GitHub, derived their addresses and combined direct key matches with transaction-pattern rules and lightweight symbolic execution on Ethereum and BNB Smart Chain.

The authors reported 99.11% precision for their overall address-misuse detection results. They randomly sampled the inferred contract-account and pattern-based EOA cases, had two researchers independently judge whether each detection matched the study's definitions, and separately treated addresses derived from public private keys as confirmed. The precision figure measures detection accuracy, not whether the full dollar estimate was directly caused by the two active vectors.

The researchers said they began disclosing the findings to wallet developers and exchanges and tried to contact affected projects. The paper does not provide a complete remediation rate or a current funded-address count for all 65,340 instances, the researchers said.

The broader crypto market analysis of address hygiene and key management continues to evolve as these attack vectors become better understood.