65,340 addresses. $574 million in losses. And only 2.7% of that comes from attacks we actually understand.
That’s the headline from a USENIX Security ’26 study that dropped this week. The researchers mined 63,000 GitHub repos, extracted 16 million private keys, and traced the carnage across Ethereum and BNB Smart Chain. The numbers are staggering. The implications? Even more brutal.
We’ve been in crypto long enough to know that most security research is academic theater. Papers get published, wallets update their UI, and the next wave of exploits hits anyway. But this one is different. It’s not about zero-day vulnerabilities or complex smart contract bugs. It’s about the dumb mistakes we all make—the kind that make you slap your forehead and say, “I knew that.”
And right now, in a bear market where every dollar counts, these mistakes are bleeding the network dry.
Context: The Two Vectors That Matter
The study breaks the problem into two categories: contract-account misuse and externally owned account (EOA) misuse. Both are avoidable. Both are widespread.
Contract-account misuse happens when you send a function call—sometimes with ETH or BNB attached—to an address that has no contract code on that network. The transaction succeeds as a simple transfer, but the funds are stuck. They sit there, waiting for someone to deploy code that can move them. And that’s exactly what attackers do.
They deploy a contract at a testnet address, wait for users to mistakenly send funds to the corresponding no-code address on mainnet, then exploit deterministic contract addressing to deploy malicious withdrawal code at the same location. The paper identified 469 malicious contracts tied to 3,446.37 ETH and 431.79 BNB in losses.
I’ve seen this play out. Back in 2020, a DeFi project I was in had a dev who left a testnet key in the code. We lost 10 ETH before we caught it. The community rallied, but the funds were gone. That’s the kind of mistake that doesn’t get headlines—it just gets swept.
The second vector uses EIP-7702, the upgrade designed to improve UX. An attacker with an exposed private key can delegate the account to malicious code that forwards a deposit to the attacker in the same transaction. 17,200 delegated addresses, 25.86 ETH plus 33.45 BNB lost. Small numbers, but it’s a signal.
Together, these two vectors account for 3,472.23 ETH and 465.24 BNB—roughly $15.7 million at May 2025 prices. The rest of the $574 million? That’s the broader set of detected contract-account and exposed-key misuse.
Core: The Data Behind the Drama
The researchers didn’t just guess. They mined 63,004 GitHub repositories from January 2015 through May 2025, plus an April 2025 Stack Exchange archive. They extracted more than 16.3 million deduplicated private keys from GitHub, derived their addresses, and combined direct key matches with transaction-pattern rules and lightweight symbolic execution on Ethereum and BNB Smart Chain.
99.11% precision. That’s not a rounding error. That’s a signal.
But here’s the kicker: the dollar valuation uses May 2025 reference prices—$4,408 per ETH and $847 per BNB. The actual losses happened at different times, at different prices. A trade that lost 10 ETH in 2022 was worth $15,000 then, but the study values it at $44,000 today. The $574 million figure is a snapshot, not a timeline. It’s useful for comparison, but it’s not a precise accounting of what was lost when.
Still, the pattern is clear. The vast majority of losses come from users sending funds to the wrong addresses, exposing private keys, or falling for social engineering. We’re not talking about advanced MEV extraction or flash loan attacks. We’re talking about basic hygiene.
Contrarian: The 97.3% of Losses We Ignore
The study’s headline is $574 million, but the two active vectors are only $15.7 million. That’s 2.7%. The other 97.3% is a silent drain—people sending funds to no-code addresses, losing keys, trusting the wrong links.
And here’s the uncomfortable truth: the crypto industry is built on narratives that ignore this. VCs push new products to solve “liquidity fragmentation,” but the real fragmentation is in user attention. Exchanges spend millions on marketing, but the cheapest security win is a wallet pop-up that says “This address has no code.”
The researchers said they began disclosing findings to wallet developers and exchanges. They tried to contact affected projects. But the paper doesn’t provide a complete remediation rate. How many of those 65,340 addresses still have funds? How many users even know they’re at risk?
We’re chasing the alpha, but we’re ignoring the bleeding.
Takeaway: The Only Alpha That Matters
The moonshot isn’t the token—it’s the tribe. And the tribe needs to stop making these mistakes.
Check the address. Check the chain. Don’t send to an address without verifying it has code. And for God’s sake, don’t commit private keys to GitHub. That’s not alpha; that’s negligence.
Yields fade, but the network remains. But only if we protect our own keys. When the next bull run comes, will you still be in the game, or will your funds be sitting in a no-code address?
Chasing the alpha, but trusting the crew.
Volatility is just noise; community is the signal.
Liquidity flows where trust is minted.