.png){kind=logo}
Researchers traced $574.8 million in losses to blockchain address misuse across Ethereum and BNB Chain, according to a USENIX Security study. The study identified 65,340 high-risk cases involving about 2.5 million transactions. Losses reached 126,982.94 ETH and 17,726.7 BNB.
The researchers calculated the dollar value using reference prices of $4,408 per ETH and $847 per BNB. Their findings covered both contract accounts and externally owned accounts.
Contract account misuse accounted for 49,344 high-risk addresses and roughly 1.6 million transactions. Those cases caused losses of 22,738.41 ETH and 8,681.41 BNB. GitHub-related cases included 21,160 BNB Chain addresses and 26,908 Ethereum addresses. Those addresses connected to losses of 7,513.66 BNB and 19,229.40 ETH.
For example, researchers examined the UniswapV2Router02 address 0xC532…4008 on Sepolia. The address had recorded about 158,775 transactions by August 2025. The same address lacked a contract code on the Ethereum mainnet, yet users still sent 88 transactions to it. An attacker then deployed a malicious contract there on October 6, 2024.
The attacker later withdrew 3.78 ETH that users had mistakenly transferred. The incident showed how the same address across different networks can expose users to losses.
Researchers also found 15,996 high-risk Externally Owned Account addresses tied to about 910,000 transactions. Those cases produced losses of 104,244.53 ETH and 9,045.29 BNB. Publicly exposed private keys caused much of the EOA damage. GitHub-related cases alone accounted for 103,402.53 ETH and 8,521.07 BNB in losses.
The study cited the Truffle test address 0x627…3Ef57 as one example. Its publicly available private key lets attackers drain funds that users accidentally send there.
Meanwhile, more than 85% of the GitHub addresses collected by researchers had not yet faced misuse. Still, their detection system achieved 99.11% precision. How much more could users lose if dormant or compromised addresses continue receiving funds across chains and applications?
Read More: Ethereum ETF vs Direct ETH Ownership: Key Differences Investors Should Know
The findings arrived alongside a separate change in Ethereum’s security strategy. Ethereum Foundation researcher Justin Drake said the network would end its work on the specialized Poseidon hash function.
Blockstream CEO Adam Back supported the decision and said he had long preferred standard hash algorithms. He argued that custom prover-friendly hashes lacked sufficient review from the wider cryptographic community.
Ethereum had spent eight years developing Poseidon for zero-knowledge systems. Yet newer proof systems changed the computational trade-offs that originally supported specialized hashes.
Binius in 2023 and Flook in 2024 enabled up to one million conventional hashes per second on an ordinary laptop. That progress reduced Poseidon’s earlier technical advantage. Ethereum now plans to return to SHA or BLAKE2s standards at Layer 1. Its timeline places LeanVM integration in 2027 and base-layer post-quantum protection completion in 2028. Separately, an AMBCrypto report placed Ethereum address-poisoning losses at about $62 million between late 2025 and early 2026.
The USENIX study traced $574.8 million in losses to address misuse across Ethereum and BNB Chain, with exposed keys and contract-address confusion driving the damage. Meanwhile, Ethereum’s move from Poseidon shifts its security roadmap toward standard hashes as LeanVM and post-quantum upgrades approach.
