Adform Supply-Chain Attack Swaps Crypto Wallet Addresses via Poisoned JavaScript

Attackers compromised a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities. Anyone who visited a site carrying the affected script on July 27 and copied a Bitcoin, Ethereum, or Tron address may have pasted a different address inserted by the malicious code instead.

The compromised resource, trackpoint-async.js, was served from s2.adform[.]net. The malicious code appended two blocks to the legitimate library, obfuscated with a six-byte XOR key. The first block monitored copy events, attempted to read the clipboard every four seconds, and replaced matching addresses. It also attempted an HTTP request to 84.32.102[.]230:7744 on page load, including the hostname and path of the visited page. The second block walked the document’s text nodes, rewrote values in input, textarea, and contenteditable elements, and hooked value setters to intercept programmatic writes. It also intercepted copy, cut, paste, and input events. Both blocks contained hardcoded replacement strings for Bitcoin, Ethereum, and Tron address patterns.

Adform says the code was not designed to install software or establish persistence and operated only while an affected page remained open. The company advises users to clear browser caches and verify wallet addresses before sending funds. Independent researcher Kevin Beaumont disclosed the compromise and noted that even recopying the wallet address would result in replacement. Max Maass published a captured copy of the script on July 27. The public timeline remains unresolved, with Adform identifying July 27 as the affected date while Beaumont observed malicious activity over the past week. Adform has not published indicators of compromise or identified the attacker.