Is MultiEye safe?

Medium risk

MultiEye uploads P2P order records, counterparty identities and payment requisites from exchange pages to multi.tradecode.tech.

On supported crypto exchange pages, the extension reads order details, counterparty identities and phone or card payment requisites from the page and its exchange API calls. It sends them to the vendor backend, authenticated with the user's vendor sign-in token, and also posts phone blacklist entries and imports HTX order history. It is a sibling build of BybitEye on the same backend.

v3.1.2Chrome Web Store
49Risk
Who publishes it

1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

1 other listing published from this account, 856 users between them. 1 of them carries a finding.

MultiEye (+HTX)856Medium

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.rapira.net
Also called by 1 other listing: BybitEye
paycat.com
Also called by 1 other listing: Monetory.Toolkit
rapira.net
Also called by 1 other listing: BybitEye

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

MultiEye sends P2P order and payment requisite data to multi.tradecode.tech

Code analysis shows order records, counterparty names and phone or card requisites read from exchange order pages are posted to multi.tradecode.tech with the signed-in vendor token.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a P2P order page on a supported exchange while signed in to MultiEye.

The extension did this

The extension posts the order, counterparty and payment requisites to multi.tradecode.tech.

Code analysis shows the calls run on page load with no per-order prompt.

Data passed to the vendor API, as read from the code
  • Requisite value
    +79001234567 (illustrative)

    The phone number or card shown as the payment destination on the order.

  • Requisite type
    PHONE (illustrative)

    Whether the value is a phone number or card.

  • Counterparty nickname
    trader_4821 (illustrative)

    The other trader's display name on the exchange.

  • Order ID and source
    binance / 2031847561 (illustrative)

    Ties the record to a specific order on a specific exchange.

  • Observed time
    2026-09-30T14:22:05.113Z (illustrative)

    When the extension saw the requisite on the page.

The code that does this

Order, counterparty and requisite upload paths

Readable version

API client methods and their endpoints

assets/getActiveUser-CgusE00R.js
async saveRequisites(e, t) {      await I.post("/v1/requisites", e, B({        source: e.source,        exchangeId: e.meta.externalId      }, t))    },    async upsertOrder(e, t) {      const {        data: n      } = await I.post("/v1/order", e, B({        source: e.source,        exchangeId: e.meta.externalId      }, t));      return n    },    async upsertCounterAgent(e, t, n) {      const {        data: r      } = await I.post("/v1/counteragent/update", e, B(n, t));      return r    }
Where the data goes
    • multi.tradecode.tech

    Vendor backend for MultiEye; receives orders, counterparties and requisites. Fallbacks multieye and multik.

Observation

The extension shares a backend family with BybitEye (hnbbaffcfmffolpekcbakpmmjglmbnmo). This build has no Bybit match and covers other exchanges. Uploads may be the intended CRM-style function.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed MultiEye contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • multi.tradecode.tech

    MultiEye sends data to multi.tradecode.tech. One other extension we have analysed sends data here.

Updated 15 October 2026ojkbhoipkhafbiobncelepmeipfoagnh