According to CoinMeta, blockchain security company ChainSecurity (SlowMist) released a report stating that they discovered during security monitoring that scripts related to the udesk customer service system had been injected with malicious code. Attackers loaded remote malicious scripts deeps.js through tampered JavaScript files, which could lead to the leakage of account credentials or the theft of sessions. In addition, the malicious scripts set replacement rules for recharge addresses targeting specific websites, allowing them to modify the BTC, ETH and other encrypted asset payment addresses displayed on the pages. They also hijacked the copy button and clipboard content, potentially causing users to transfer funds to addresses controlled by the attackers. ChainSecurity pointed out that data collection was not limited to specific websites, and the address replacements only took effect on certain pages.