The attack did not touch exchange servers at all. SlowMist traced malicious code injected into Udesk customer support scripts, a third-party chat widget that sites embed on their pages, which quietly loads a second payload from the lookalike domain udeskqlobal.com.

Once on a page, the script collects cookies, localStorage, sessionStorage and data submitted through login and other forms, which could let attackers hijack sessions or take over accounts.

On deposit pages of three exchanges (mgbx.com, bikingex and bitxex.io), the script swaps displayed deposit addresses for BTC, EVM, TRON, Solana, LTC and DOGE and rewrites the clipboard, sending deposits to attacker wallets.

SlowMist advises affected sites to stop serving the compromised script, revoke exposed sessions and rotate credentials. Users are urged to verify deposit addresses through a trusted channel before sending funds.