Study documents $574.8M in Ethereum and BNB Chain address losses

An academic study involving researchers from Sun Yat-sen, Zhejiang, Peking, and other universities documented 65,340 high-risk cases of address misuse across Ethereum and BNB Smart Chain, totalling nearly $574.8 million in losses. The cases involved contract addresses, exposed accounts, and cross-chain address reuse, with many transactions completing successfully despite assets being sent to wrong or unsafe destinations.

Contract Account Misuse accounted for 49,344 cases, involving 22,738.41 ETH and 8,681.41 BNB. These errors occurred when users assumed a contract existed at a familiar address but that assumption failed when switching networks. The same hexadecimal address might contain functional code on a testnet yet nothing on mainnet. A shared Uniswap V2 router address exemplified the problem: developers used it on Ethereum's Sepolia testnet, generating over 102,000 Stack Exchange views, but the address held no contract code on mainnet. Users still submitted function calls and sent ETH, which the network accepted as simple transfers, leaving assets trapped.

Attackers exploited earlier mistakes through deliberate cross-chain address reuse. Researchers identified 469 contract cases where attackers deployed malicious contracts at destinations where users had previously sent funds by error, resulting in losses of 3,446.37 ETH and 431.79 BNB. The research also covered Externally Owned Account Misuse, identifying 15,996 cases tied to exposed private keys. The study emphasized that address verification must include chain-specific checks and bytecode confirmation rather than relying on recognizable addresses alone.