Is MultiEye (+HTX) safe?

Medium risk

MultiEye (+HTX) uploads P2P order records, counterparty details and card or phone numbers from exchange pages to tradecode.tech.

On supported crypto exchange P2P pages (Bitget, MEXC, KuCoin, Gate, Rapira, HTX, Binance) the extension reads order data, counterparty names and IDs, and extracts card and phone numbers from order chats. It sends these to the vendor's multi.tradecode.tech backend (with multieye and multik fallbacks), authenticated with the user's vendor sign-in token. The content scripts run only on the exchange P2P domains.

v3.1.2Chrome Web Store
49Risk
Who publishes it

1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

1 other listing published from this account, 175 users between them. 1 of them carries a finding.

MultiEye175Medium

Shared hosts - 6 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.rapira.net
Also called by 1 other listing
multi.tradecode.tech
Also called by 1 other listing: BybitEye
multieye.tradecode.tech
Also called by 1 other listing: BybitEye
multik.tradecode.tech
Also called by 1 other listing: BybitEye
rapira.net
Also called by 1 other listing: BybitEye
c2c.binance.com
Also called by 3 other listings, including Monetory.Toolkit, Vouch Verifier

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

MultiEye uploads P2P chat card numbers and counterparty names to tradecode.tech

Code analysis shows card and phone numbers from exchange P2P order chats, plus counterparty names, are posted with order IDs to multi.tradecode.tech while you view an order page.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a P2P order page on a supported exchange while signed in to the extension.

The order chat contains a counterparty's card or phone number.

The extension did this

The content script extracts the numbers and posts them with the order ID to multi.tradecode.tech.

The service worker also posts order and counterparty records to the same backend.

Fields sent to the vendor backend per order
  • Payment requisite
    CARD: 4276 0000 0000 0000 (illustrative)

    A card or phone number a counterparty shared in the order chat.

  • Counterparty identity
    nickname, uid, fullName (illustrative)

    The other trader's nickname, exchange UID and full name.

  • Order ID
    orderId, externalId (illustrative)

    Ties the payment details to a specific exchange order.

  • Observation time
    2026-09-01T12:00:00.000Z (illustrative)

    When the extension saw the details.

  • Account token
    Authorization: Bearer <redacted>

    A bearer token from the vendor sign-in authorises the upload.

The code that does this

Upload call and the client helpers it uses

Readable version

API client methods

content.js
async saveRequisites(a, i) {  await We.post("/v1/requisites", a, rt({    source: a.source,    exchangeId: a.meta.externalId  }, i))},async upsertCounterAgent(a, i, r) {  const { data: s } = await We.post("/v1/counteragent/update", a, rt(r, i));  return s}

Card number pattern in the chat parser

content.js
new RegExp("(?<!\\d)(\\d{4}[\\s-]?){3}\\d{4}(?!\\d)", "g")
Backend hosts configured in the axios client
    • multi.tradecode.tech

    Primary endpoint for order, counterparty and requisite uploads.

    • multieye.tradecode.tech

    Fallback endpoint used if the primary fails.

    • multik.tradecode.tech

    Second fallback endpoint with the same API path.

The code that does this

Hardcoded backend base URLs

Readable version
A1 = "https://multi.tradecode.tech/multi",_1 = "https://multieye.tradecode.tech/multi",O1 = "https://multik.tradecode.tech/multi",
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed MultiEye (+HTX) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • multi.tradecode.tech

    MultiEye (+HTX) sends data to multi.tradecode.tech. One other extension we have analysed sends data here.

  • multieye.tradecode.tech

    MultiEye (+HTX) sends data to multieye.tradecode.tech. No other extension we have analysed sends data here.

  • multik.tradecode.tech

    MultiEye (+HTX) sends data to multik.tradecode.tech. No other extension we have analysed sends data here.

Updated 15 October 2026lnhoajmfjphahgjjnklcmgcjnampfjhd