Blockchain security firm SlowMist reported that JavaScript connected to Udesk, a customer service chat widget embedded by many websites, was used to collect visitor login credentials and redirect crypto deposits on at least three trading platforms.
Security flaw targets crypto exchanges
SlowMist stated on Tuesday that its analysts discovered the malicious code during their routine threat monitoring procedures. According to the firm, their MistEye monitoring system detected and alerted their clients to the issue, raising concerns about the scope of the compromise.
Udesk is a third-party customer service software provider frequently integrated by exchanges and online businesses to facilitate client communication. By intercepting this widely used widget, attackers were able to reach users across several platforms.
The tampered file, named udeskApi.2026-10-16.cached.js, contained a hidden short loader script appended after the legitimate widget code. The loader’s intended target was obfuscated in hexadecimal format, making it difficult to detect using standard searches for readable domains.
Once decoded, the loader extracted a second malicious script from a domain called udeskqlobal[.]com—a misspelling used specifically to evade simple domain checks. SlowMist recommended maintaining the exact spelling, with a “q”, when reviewing web logs for evidence of compromise.
Mini dictionary: Udesk, a cloud-based customer service platform, offers businesses online support solutions through live chat, tickets, and integration capabilities, making it a popular widget on e-commerce and trading sites.
Scope and method of attack
SlowMist clarified that the malicious code was not confined to the three crypto exchanges originally named. The report stated that even if a website’s address did not match those targets, the script would still begin data collection and install monitoring hooks. Furthermore, using an iframe to embed the customer service widget did not shield the host website, as scripts loaded via the iframe could still interact with user sessions and collect sensitive data.
For MGBX, Biking Exchange, and BitxEX, a second module was triggered specifically on their deposit pages. The injected code reviewed these pages every 200 milliseconds, dynamically replacing displayed wallet addresses with one of six attacker-controlled addresses compatible with Bitcoin, EVM chains, Tron, Solana, Litecoin, and Dogecoin. To further conceal its presence, the attack also altered any copied deposit address text through multiple technical routes, making it difficult for users to detect the swap even if they compared pasted text to the original page.
| Exchange Targeted | Attack Mechanism | Assets Affected |
|---|---|---|
| MGBX | Deposit address swap every 200ms, hooks user actions | BTC, EVM Chains, Tron, Solana, Litecoin, Dogecoin |
| Biking Exchange | Deposit address swap, tracks copy-paste activity | BTC, EVM Chains, Tron, Solana, Litecoin, Dogecoin |
| BitxEX | Deposit address swap, clipboard rewrite | BTC, EVM Chains, Tron, Solana, Litecoin, Dogecoin |
Unclear impact and recommended actions
SlowMist did not specify how the malicious code was introduced into the Udesk script or how many companies incorporated the compromised file. The firm also did not confirm if any cryptocurrency funds were actually lost due to this incident.
In its advisory, SlowMist urged organizations still employing the compromised scripts to remove them immediately, secure any leaked credentials, and verify that deposit addresses match those listed in their trusted records and backend systems. The firm warned that simply deleting the malicious script tag is insufficient, as previously activated hooks and timers will continue to operate. Instead, SlowMist recommended closing affected pages and resetting all passwords and access tokens from a secure system.
SlowMist’s report emphasized that removing the embedded script does not deactivate malicious hooks or timers already in the system, urging businesses to conduct thorough clean-up and security reviews after exposure.
Previous incidents highlight persistent threat
Incidents involving compromised third-party code continue to affect the crypto sector. In December 2023, a tampered version of Ledger’s widely used Connect Kit integration library was responsible for draining around $500,000 from users’ wallets on popular decentralized application interfaces such as SushiSwap and Zapper.
These events underscore the necessity for constant vigilance regarding the external tools and code that exchanges and crypto service providers deploy to their user base.
Third-party code risks are an ongoing challenge for the digital asset industry, with recent attacks illustrating that even widely trusted libraries and services can become a threat vector when targeted by sophisticated adversaries.
