Testnet addresses can become dangerous when users assume the same address works identically on the mainnet.
A new academic study has identified 65,340 high-risk address misuse cases on Ethereum and BNB Chain, linked to about $574.8 million in lost crypto.
The research shows how ordinary mistakes involving testnet addresses, reused contract addresses, and exposed private keys can become permanent losses, while newer tools such as EIP-7702 give attackers another way to exploit them.
Address Mistakes Account for Millions in Losses
The study, led by researchers from Sun Yat-sen University, Zhejiang University, Peking University, and other institutions, describes two forms of address misuse: Contract Account (CA) Misuse and Externally Owned Account (EOA) Misuse.
CA Misuse happens when users treat a non-contract address as though a smart contract exists there. The researchers found 49,344 such cases, involving 22,738.41 ETH and 8,681.41 BNB in losses.
One example involved a Uniswap V2 router address widely used on Ethereum’s Sepolia testnet. The address had more than 102,000 views across Stack Exchange posts and was used frequently for testing, but on Ethereum mainnet, it had no contract code at the time, yet users still sent function calls and ETH to it. The transactions succeeded as simple transfers, leaving the funds trapped.
EOA Misuse accounted for another 15,996 cases, which involved addresses whose private keys had been exposed, often through public code repositories or developer Q&A sites. The study found losses of 104,224.53 ETH and 9,045.29 BNB.
The researchers examined more than 10 million candidate addresses and 16 million exposed private keys, then analyzed about 2.5 million transactions on Ethereum and BSC. Manual checks gave the detection system an overall precision of 99.11%.
You may also like:
The study also found that attackers actively exploit these mistakes. In 469 CA misuse cases, attackers used cross-chain address reuse to place malicious contracts at addresses where users had already trapped funds, resulting in 3,446.37 ETH and 431.79 BNB in losses.
Another 17,270 cases involved EIP-7702, which lets an externally owned account delegate execution to a smart contract. The researchers found attackers using the mechanism to control exposed accounts and automatically redirect incoming funds.
Why Familiar Addresses Can Become a Trap
The findings add a different type of risk to the security problems already affecting crypto this year. A Blockaid report published on August 1 found $1.1 billion stolen across 212 incidents during the first half of 2026, with three separate attacks that caused more than $35 million in losses occurring in one day in late July.
The address misuse study points to a less obvious problem: a transaction can succeed while still producing a loss. Users may assume that a successful transaction means they interacted with the intended contract, even when the address has no code on that particular network.
According to the researchers, people ought to check the network before using an address and rely on official project documentation while keeping test accounts away from production funds.
They also called for wallets to warn users when an address has no contract code on the current chain or has a known exposed private key.
