Security researchers at SlowMist reported a supply-chain risk where a third-party support tool can silently replace cryptocurrency deposit addresses on exchange websites.

How the compromise works

According to SlowMist, the issue stems from malicious code embedded in a third-party technical support service integrated into site pages. Attackers can intercept and modify the deposit field displayed to users without breaching the exchange itself.

Implications for users and platforms

This technique allows funds intended for an exchange to be redirected to attacker-controlled wallets while users copy addresses from a familiar interface. The attack exploits the trust placed in external widgets and does not require direct access to the exchange back end.

Third-party service involved

SlowMist identified the vector as code related to Udesk, a customer support integration commonly used on corporate websites. Compromise of such services can affect many sites that embed their scripts, increasing the blast radius of a single incident.

Recommendations and context

SlowMist advises reviewing embedded third-party scripts and monitoring integrity of client-side code loaded on deposit pages. Platforms are urged to apply script integrity checks and limit exposure to external widgets handling sensitive inputs.