$575M of Losses Traced to Keys Developers Committed to GitHub

A paper accepted to USENIX Security '26, authored by Zhenzhe Shao of Sun Yat-sen University and Zhejiang University, extracted more than 16.3 million deduplicated private keys from 63,004 public GitHub repositories covering January 2015 through May 2025, and linked 65,340 high-risk address instances to an estimated $574.8 million in losses on Ethereum and BNB Smart Chain ^[1][2][3]. The operator-relevant part is not the headline total but where the exposure originates: version control, an asset every engineering organisation already owns and can instrument.

The composition is more instructive than the sum. Of the flagged instances, 49,344 were contract account misuse and 15,996 were externally owned account misuse ^[4], meaning roughly three quarters of the identified exposure sits in deployed contract logic rather than in individual wallets ^[14]. Averaged across the set, each high-risk instance carries about $8,800 of quantified loss ^[19]. The dataset also averages roughly 259 keys per repository ^[20], which is not consistent with a picture of one careless developer leaking one key; the study attributes the pattern to developers hardcoding keys into projects for convenience and pushing without scrubbing ^[11].

The dollar figure deserves scrutiny. Realized losses were measured as 126,982.94 ETH and 17,726.7 BNB ^[6], converted at stated May 2025 valuations of $4,408 per ETH and $847 per BNB ^[7]. That puts about $559.7 million on the Ethereum leg and about $15.0 million on the BNB leg ^[15][16], so roughly 97 percent of the headline rests on a single asset priced at a single point in time ^[17]. Every 10 percent move in the assumed ETH price shifts the total by about $56 million ^[18]. Read $575 million as an order of magnitude, not a settlement figure. The authors themselves scope it as only what could be directly quantified on two chains, and say global damage across all blockchains is likely larger ^[12].

Two attack vectors the paper describes as previously undocumented are worth logging even though they are small in dollar terms: deployment to deterministic contract addresses derived from exposed keys, and EIP-7702 delegation, which lets an externally owned account delegate execution to contract code ^[8][13]. Together they account for about $15.7 million, or 2.7 percent of the quantified damage ^[9]. The number is minor. The timing is not, since it indicates a recently added account abstraction feature was already being turned into a monetisation path for leaked keys.

On method, the researchers combined heuristic rules, transaction pattern analysis and symbolic execution, reporting 99.11 percent overall precision in validation ^[10]. Applied to 65,340 instances, that residual implies on the order of 580 flagged instances could be misclassified ^[21], which does not change the conclusion. Nor does the timeline flatter anyone: spread across the ten-year window, the losses run to roughly $56 million a year ^[22].

What to watch: whether the EIP-7702 share of losses grows past 2.7 percent as delegation adoption widens ^[9], and whether the flagged addresses keep transacting, given the 2.5 million transactions already tied to them ^[5]. Crypto Briefing's summary of the paper states the practical rule bluntly, and it is the right one for treasury and key custody policy: if a key has touched a public repository, a shared document or a screenshot, treat the address as compromised ^[23].