Academic Study Documents $574.8M in Ethereum and BNB Chain Address Losses

An academic team from Sun Yat-sen, Zhejiang, Peking and other universities has documented widespread losses stemming from address errors on Ethereum and BNB Smart Chain. The study identified 65,340 high-risk cases involving contract addresses, exposed accounts, and cross-chain reuse totalling $574.8 million.

The researchers categorized the problem into two types: Contract Account Misuse and Externally Owned Account Misuse. Contract Account Misuse occurs when users assume a contract exists at a familiar address, an assumption that fails when switching between networks. The same hexadecimal address may contain working code on a testnet but nothing on mainnet. The study documented 49,344 such cases involving 22,738.41 ETH and 8,681.41 BNB. Transactions can receive network confirmation even when the intended contract function never executes, with the blockchain treating the call as a basic payment to an address without code.

A specific example involved a shared Uniswap V2 router address used on Ethereum's Sepolia testnet that lacked contract code on Ethereum mainnet. Users submitted function calls and attached ETH, but the assets became trapped as the network accepted them as simple transfers.

The research also revealed that attackers deliberately exploited earlier mistakes. In 469 contract cases, attackers deployed malicious contracts at destinations where users had previously sent funds accidentally, turning prior errors into active theft opportunities and causing losses of 3,446.37 ETH and 431.79 BNB. The findings underscore why Ethereum address errors require chain-specific verification before transactions are signed.