Academic study links 65,340 high-risk crypto addresses to $575M in losses from exposed private keys

Someone, somewhere, pushed their private key to a public GitHub repository. Then 65,339 other someones did roughly the same thing. A peer-reviewed study accepted to USENIX Security ’26, one of the top academic security conferences in the world, has now catalogued the damage: 65,340 high-risk address instances tied to an estimated $574.8 million in losses across Ethereum and BNB Smart Chain.

The paper, authored by Zhenzhe Shao from Sun Yat-sen University and Zhejiang University, represents one of the most comprehensive audits of blockchain address misuse ever conducted.

What the researchers actually found

The study analyzed over 16.3 million deduplicated private keys extracted from 63,004 public GitHub repositories. The data spanned a full decade, from January 2015 through May 2025, capturing keys that developers, students, and hobbyists had inadvertently (or carelessly) committed to version control.

From that trove, the team identified 65,340 high-risk address instances. Those broke down into two categories: 49,344 cases of contract account (CA) misuse and 15,996 cases of externally owned account (EOA) misuse. Together, the addresses were involved in roughly 2.5 million transactions.

A contract account is a smart contract deployed on-chain, while an EOA is a regular wallet controlled by a private key. When either type of account has its keys floating around on the open internet, bad things tend to follow. In this case, those bad things added up to approximately 126,982.94 ETH and 17,726.7 BNB in realized losses.

At May 2025 valuations of $4,408 per ETH and $847 per BNB, the total damage exceeds $574.8 million.

Two new attack vectors nobody was watching for

Beyond quantifying the carnage from known vulnerability patterns, the researchers uncovered two previously undocumented attack vectors. The first exploits deterministic contract addresses, where smart contracts are deployed to predictable locations derived from exposed keys. The second takes advantage of EIP-7702 delegation, a relatively new Ethereum feature that allows EOAs to delegate execution to contract code.

These two novel vectors accounted for approximately $15.7 million in losses, or about 2.7% of the total quantified damage.

The detection methodology itself performed remarkably well. The researchers combined heuristic rules, transaction pattern analysis, and symbolic execution into a framework that achieved a 99.11% overall precision rate during validation.

Why private keys keep ending up on GitHub

The root cause is almost painfully mundane. Developers testing smart contracts or building blockchain applications often hardcode private keys into their projects for convenience. When they push that code to a public repository without scrubbing the sensitive data first, those keys become available to anyone with a search engine.

The scale of the dataset, 63,004 repositories yielding over 16 million unique keys, indicates this isn’t a problem limited to a few careless newcomers. It spans the entire developer ecosystem, from weekend projects to what were likely production environments.

What this means for the security landscape

The $574.8 million figure represents only the losses the researchers could directly quantify on Ethereum and BNB Smart Chain. The actual global damage from private key exposure across all blockchains is almost certainly larger, though this study wisely stuck to what it could measure with high confidence.

For Ethereum users specifically, the discovery of the EIP-7702 delegation attack vector is worth paying attention to. EIP-7702 is part of Ethereum’s ongoing evolution toward account abstraction, a set of upgrades designed to make wallets more flexible and user-friendly. The fact that researchers have already found a way to weaponize it using exposed keys suggests that new features can introduce new attack surfaces faster than the ecosystem adapts.

For individual holders, the takeaway is blunt: if a private key has ever touched a public repository, a shared document, a screenshot, or basically anything connected to the internet, the associated address should be considered compromised. The 2.5 million transactions linked to these high-risk addresses show that attackers are industrious, systematic, and very patient.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.