Adform Ad Script Hacked to Redirect Crypto Wallet Addresses
Attackers compromised a shared JavaScript file to alter cryptocurrency transactions globally.
1Incident Scope
Adtech firm Adform's JavaScript file was modified by hackers to automatically replace cryptocurrency wallet addresses. Detected on July 27, 2026, the attack affected thousands of websites through the trackpoint-async.js file. Targeting Bitcoin, Ethereum, and Tron addresses, attackers attempted to redirect users' transfers to wallets under their control.
2Technical Details
Attackers appended two malicious blocks to Adform's shared JavaScript file, obfuscated with a 6-byte XOR key. The first block monitored clipboard events, checking every 4 seconds for matching addresses to replace. The second block scanned text nodes, automatically modifying values in input and textarea fields while preserving cursor positions after alterations.
3User Risks
Users visiting affected sites on July 27 may have unknowingly sent cryptocurrency to attacker-controlled addresses. Adform advises clearing browser caches and double-checking wallet addresses before transfers. The attack modified both clipboard-copied addresses and those manually entered into form fields, demonstrating sophisticated interception capabilities.
4Attack Propagation
Adform's 2025 reports showed operations in 180+ countries serving 1.8 billion daily ad impressions. By compromising this shared infrastructure, attackers gained access to hundreds of downstream websites simultaneously. Such supply-chain attacks create broader impact than targeting individual sites, magnifying the potential damage exponentially.
5Security Researchers' Findings
Independent researcher Kevin Beaumont discovered the compromise, noting the file showed no VirusTotal detections. Beaumont observed the script persistently replaced addresses even after user corrections. Max Maass published a captured script copy on July 27, enabling technical analysis of the attack methodology and replacement patterns.
6Company Response & Gaps
Adform removed the malicious code and notified authorities but left critical questions unanswered regarding affected site counts or stolen funds. Their incident notice lacked Indicators of Compromise (IoCs), hindering independent verification. The attack's start time remains unclear, with discrepancies between Adform's July 27 claim and researchers' observations of longer activity.
7Industry Implications
This incident demonstrates how vulnerabilities in ad tech providers can have cascading consequences. Serving 1.5 billion daily impressions in 2025, Adform's infrastructure presented a high-value target. The breach highlights systemic risks when thousands of sites rely on shared third-party resources without adequate security oversight.
8Key Takeaways
The attack underscores risks inherent in third-party script dependencies. Companies must invest in supply-chain security while users should implement additional verification steps for crypto transactions. Adform's limited disclosure emphasizes the need for cybersecurity transparency. Preventing such attacks requires cross-industry collaboration on shared infrastructure security standards.