USENIX Research Identifies 65,000 Malicious Addresses Linked to $580 Million in Crypto Theft

The authors attribute the losses to two attack vectors: misuse of deterministic contract addresses and exploitation of EIP-7702. For smart contract developers, this is not a headline. It is a catalogue of failures that should never have shipped.

Deterministic Address Attacks

CREATE and CREATE2 produce predictable addresses. Attackers compute the future address of a contract before deployment and pre-position logic, balances, or approvals at that location. The result is a compromised state at the moment of initialization. The invariant — "deployed contract starts from a clean, owner-controlled state" — fails.

The mitigations are not new. They are simply not enforced:

• Send deployment transactions from a new, single-use EOA with no prior history.
• Never deploy to an address that has received any prior token transfers or contract calls.
• Use CREATE2 salts that include a high-entropy secret disclosed only after deployment.
• Verify msg.sender and contract code hash invariants immediately after deployment.

Most of the 126,982.94 ETH lost in this category traces back to predictable front-running against unprotected factory patterns.

EIP-7702 Delegation Abuse

EIP-7702 lets EOAs temporarily adopt smart contract code via a signed authorization. The study flags this as a live attack surface. A compromised signer delegates control to an attacker-controlled implementation. Funds move. The original keyholder sees a normal-looking account until the next sweep.

This is not a flaw in the EIP. It is a flaw in how keys are managed. The authorization object is a signed message. Anyone with the key can sign one.

Practical controls:

• Hardware signing for any address that will ever submit a 7702 authorization.
• Separate hot and cold EOAs. Never delegate from a cold key.
• Monitor the 0xef0100 prefix on your addresses. Any unexpected delegate is a compromise event.
• Revoke delegations immediately if the key has been exposed, even briefly.

What the Numbers Show

17,726.7 BNB sit alongside the ETH figure. The ratio is not the point. The point is that both networks share the same failure modes: predictable deployment and delegable authority. Code-level invariants are bypassed because key-level invariants were never enforced.

Audit scope must extend past the contract. It must cover deployment origin, key custody, and the lifecycle of signed authorizations. Anything less is theater.