TLDR:
- Ethereum address errors were linked to 65,340 high-risk cases and almost $574.8 million in losses across Ethereum and BNB Chain.
- Contract account misuse involved 49,344 cases, with 22,738.41 ETH and 8,681.41 BNB sent to addresses lacking expected code.
- Exposed private keys contributed to 15,996 account misuse cases involving 104,224.53 ETH and another 9,045.29 BNB across both blockchains.
- Researchers identified 17,270 EIP-7702 cases where malicious delegation helped attackers control exposed accounts and redirect deposits.
An academic study links Ethereum address errors and similar BNB Chain mistakes to nearly $574.8 million in losses. Researchers identified 65,340 high-risk cases involving contract addresses, exposed accounts, and cross-chain reuse. Many transactions completed successfully, although users sent assets to the wrong destination or an unsafe account.
This makes the problem harder to spot than a failed transfer. The research team includes scholars from Sun Yat-sen, Zhejiang, Peking, and other universities. Their work traces crypto address misuse across Ethereum and BNB Smart Chain. It also shows how EIP-7702 can help attackers seize exposed accounts and redirect incoming funds automatically.
Ethereum Address Errors Expose Cross-Chain Transfer Risks
The researchers divide the problem into Contract Account Misuse and Externally Owned Account Misuse. Contract Account Misuse occurs when someone assumes a contract exists at a familiar address. That assumption can fail when the user switches networks. The same hexadecimal address may hold working code on a testnet but nothing on mainnet.
The study documented 49,344 separate contract misuse cases involving 22,738.41 ETH and 8,681.41 BNB. These Ethereum address errors appeared routine. A transfer can receive confirmation even when the intended contract function never runs. The network simply treats the call as a basic payment to an address without code.
A shared Uniswap V2 router address illustrates the danger. Developers used it on Ethereum’s Sepolia testnet, and related Stack Exchange posts attracted more than 102,000 views. Yet the address lacked contract code on Ethereum mainnet. Users still submitted function calls and attached ETH. The chain accepted those transactions as simple transfers, leaving the assets trapped.
Attackers watched addresses affected by crypto address misuse. The team identified 469 contract cases involving deliberate cross-chain address reuse. Attackers deployed malicious contracts at destinations where users had previously sent funds by mistake. Those incidents caused losses of 3,446.37 ETH and 431.79 BNB. The method turns an earlier mistake into an active theft opportunity.
These findings show why Ethereum address errors require chain-specific checks. A recognizable address alone does not confirm the expected contract exists. Users must verify both the selected network and the deployed bytecode before signing a transaction.
Exposed Keys and EIP-7702 Expand the Threat to Users
Ethereum address errors also include Externally Owned Account Misuse. The study identified 15,996 cases tied to private keys exposed online. Developers sometimes publish keys in repositories, tutorials, or question-and-answer posts. Attackers can monitor those accounts and remove deposits as soon as funds arrive.
These exposed accounts received 104,224.53 ETH, while related BNB Chain losses reached 9,045.29 BNB. Researchers examined more than 10 million candidate addresses and 16 million exposed private keys. They then reviewed roughly 2.5 million transactions across Ethereum and BNB Smart Chain. Manual validation placed the detection system’s overall precision at 99.11%.
EIP-7702 expands the danger surrounding Ethereum address errors. The upgrade allows an externally owned account to delegate execution to smart contract code. Researchers found another 17,270 cases where attackers used this mechanism against exposed accounts. Malicious delegation enabled automatic control and redirected later deposits without repeated manual action.
The losses sit beside broader security damage recorded during 2026. Blockaid reported $1.1 billion stolen through 212 incidents during the first half. Three separate attacks each caused more than $35 million in losses on one late-July day. Unlike visible hacks, crypto address misuse can look like an ordinary confirmed transaction.
The researchers urge users to obtain addresses from official project documentation. Test accounts and production wallets should also remain separate. Wallets could flag addresses without contract code on the current chain. They could also warn when known exposed keys control a destination. Such checks would target Ethereum address errors before users approve irreversible transfers.
