65,340 addresses. $574.8 million in locked or stolen assets. The losses weren't from smart contract exploits, oracle manipulation, or flash loan attacks. They came from a far simpler mistake: sending funds to the wrong address type. A new study by researchers from Zhongshan University, Zhejiang University, and Peking University has quantified the scale of address misuse across Ethereum and BNB Chain. The data is cold, precise, and damning. And it reveals a blind spot the market has chosen to ignore.
Context: What the Data Actually Measures
The research team analyzed 2.5 million transactions, scanning over 10 million candidate addresses and 16 million exposed private keys. Their detection system achieved 99.11% precision. They classified address misuse into two categories: contract address (CA) misuse—sending funds to a contract that has no code or logic on the target chain—and externally owned account (EOA) misuse—sending funds to an address whose private key has been publicly leaked, often via GitHub or developer forums. The study also uncovered a new attack vector tied to EIP-7702, where an attacker can delegate execution control over an exposed account, automatically redirecting incoming funds. Bear markets demand disciplined forensics, and this is exactly the kind of granular audit that separates signal from noise.
Core: The On-Chain Evidence Chain
The numbers break down like this: CA misuse accounted for 22,738.41 ETH and 8,681.41 BNB locked in dead addresses. EOA misuse, where private keys were leaked, cost 104,224.53 ETH and 9,045.29 BNB. That’s a total of 126,963 ETH and 17,726.7 BNB—roughly $574.8 million at current prices. Not a single smart contract was exploited. Every gas fee tells a story of intent, and here the intent was correct, but the destination was fatally wrong.
EIP-7702 introduces a new layer of risk. By allowing account delegation to smart contracts, attackers can silently hijack exposed accounts. The study found 17,270 such cases already. The attack is stealthy: the user still controls the account, but execution logic has been replaced. A wallet interface may show ownership, but the funds will flow to the attacker’s designated contract. Code does not lie, only developers do, and EIP-7702’s flexibility is a double-edged sword.
Cross-chain address reuse attacks—469 cases identified—show that attackers are actively monitoring testnet addresses that have no corresponding mainnet contract. They deploy a malicious contract on the mainnet at the same address, then wait for users to send funds. The Sepolia testnet’s widely used Uniswap V2 router address appears in over 102,000 Stack Exchange views. It is routinely used for testing. On mainnet, that address is a ghost. Users send ETH, and the transaction succeeds, but the funds are frozen. The ledger lines reveal what noise obscures: the system works; the user interface lies.
Contrarian: Correlation Is Not Causation
The market spends billions on auditing smart contracts and monitoring for hacks. But the biggest source of loss here is not malicious code—it is user behavior. The assumption that a successful transaction implies a successful interaction with the intended contract is false. The study’s authors call for wallets to integrate address code checks, but the industry’s focus on “security” has been myopic. Efficiency is the only permanent alpha, and standardizing address verification across wallets would eliminate a significant portion of these losses overnight. Yet, the market narrative still prioritizes DeFi yields and layer-2 scaling over basic user protection. The data proves that the risk is real, but the incentive to fix it is weak because the losses are spread across thousands of individual users—not a single protocol holding billions in TVL.
Takeaway: The Next-Week Signal
The next catalyst is not a price move. It is a product update. If major wallets—MetaMask, Rabby, Trust Wallet—announce integration of the detection system’s logic, the impact will be immediate: a reduction in address misuse losses, but also a shift in attack vectors toward more sophisticated methods. The standardization of address verification will become a benchmark for institutional-grade self-custody. Until then, every user is their own auditor. And the data says most are failing.