Overview
- The USENIX Security ’26 paper, published Friday, catalogued 65,340 high-risk address instances on Ethereum and BNB Smart Chain that together match the study’s measured token losses.
- Researchers measured about 126,982.94 ETH and 17,726.7 BNB lost and converted those totals to a standardized $574.8 million using May 2025 reference prices.
- The team uncovered two previously undocumented attack vectors: predictable contract-address deployment that lets attackers place malicious code at a known no-code address, and EIP-7702 delegation abuse that can forward deposits to attackers in a single transaction.
- Methodology combined private-key matches, transaction-pattern rules, and symbolic execution and yielded 99.11% validation precision, but the paper does not report a full remediation rate or an up-to-date count of still-funded flagged addresses.
- The root cause is common developer practice of hardcoding or accidentally committing private keys to public repos, which enables fast automated sweep-and-drain attacks and suggests the real cross-chain exposure is likely larger than the study’s measured scope.