A study presented at USENIX Security '26 has identified 65,340 high-risk crypto addresses tied to abuse across Ethereum and BNB Smart Chain, with combined native-token losses of 126,982.94 ETH and 17,726.7 BNB — together valued at more than $574.8 million.
The most striking part of the research is where most of those addresses came from. Researchers combed through 63,004 GitHub repositories and extracted more than 16.3 million deduplicated private keys that had been accidentally committed to public code, then derived the corresponding wallet addresses and cross-referenced them against transaction-pattern rules and lightweight symbolic execution to confirm which had actually been exploited on-chain.
Leaked Keys Are Only Part of the Picture
Notably, the two specific active attack vectors the researchers documented in detail accounted for only about $15.7 million combined — roughly 2.7% of the study's broader loss estimate. That means the overwhelming majority of the $574.8 million traces back to other, less-mapped forms of address misuse rather than the two techniques the paper singles out. The first of those two involved misuse of contract accounts and deterministic contract addresses; the second exploited EIP-7702, Ethereum's account-abstraction upgrade, by redirecting compromised accounts to malicious code capable of transferring out funds. The full methodology and findings are detailed in the researchers' pre-publication paper.
What EIP-7702 Abuse Reveals
EIP-7702 lets ordinary wallets temporarily behave like smart contracts, enabling legitimate features such as batched transactions and sponsored gas fees. The study shows the same mechanism creates a fresh liability once a private key is already compromised: rather than simply draining a wallet once, an attacker can redirect it wholesale to attacker-controlled logic, turning a single leaked key into an open-ended vector for further abuse.
Related: Fake Hyperliquid Google Ad Drains About $550,000 From Users
A Reminder That Old Mistakes Compound
The sheer volume of leaked keys — more than 16.3 million pulled from public GitHub repositories alone — underscores that most crypto losses still trace back to old, avoidable mistakes rather than novel zero-day exploits. What the research adds is a warning that those old leaks don't stay static: as Ethereum adopts newer account-abstraction standards like EIP-7702, previously dormant compromised keys can be weaponized in new ways years after the original leak occurred.
