On July 27, 2026, Adform detected a malicious alteration to its trackpoint-async.js script that could silently swap cryptocurrency wallet addresses on any site that loaded the file.
Key Takeaways
- The compromised script rewrote Bitcoin, Ethereum, and Tron addresses both from clipboard events and directly in form fields.
- Adform’s shared JavaScript resource made the attack a supply‑chain breach affecting unrelated downstream sites.
- Attackers sent page hostnames and paths to 84.32.102.230:7744 on load, potentially exposing visitor data.
- Adform advises clearing browser caches and verifying wallet addresses before any transfer.
- Scope remains unknown; no public indicator of compromise has been released.
Adform Script Hack Exposes Thousands of Websites
Kevin Beaumont, an independent security researcher, first reported the malicious activity after observing the altered script over the past week. “Even if you notice the address is wrong and recopy the wallet, it keeps replacing it,” he wrote when disclosing the compromise. The script was served from s2.adform.net, a domain that powers tracking across Adform’s network of roughly 1,800 customers and delivers about 1.5 billion ads daily.
Because the compromised file is a shared library, the attackers didn’t need to breach each website individually. Instead, they hijacked a single point of deployment, turning the script into a universal weapon that could affect any page that included it. That’s the irony of supply‑chain attacks: the breach lives in a trusted component, not in the downstream code.
Historical Context of Supply‑Chain Threats in Advertising
Supply‑chain attacks have haunted the ad‑tech ecosystem for years. When a third‑party provider distributes a single JavaScript bundle to thousands of clients, the attacker’s use multiplies. Earlier incidents demonstrated that a malicious payload can travel unnoticed across a network of sites that share the same vendor script. Those lessons underscore why a breach at the source, rather than at an individual publisher, is especially dangerous.
Adform’s scale—nearly two thousand customers and billions of ad impressions—places it among the most widely integrated platforms. In that environment, any alteration to a core script instantly becomes a global risk. The model mirrors past events where a compromised library propagated malicious code to a broad audience, highlighting a persistent tension between convenience and security.
Industry observers have repeatedly warned that trust placed in a single vendor can become a single point of failure. The current incident validates those warnings. It also shows that even mature providers, with extensive monitoring and compliance programs, can be infiltrated. The takeaway is clear: no supply‑chain component is immune.
Technical Architecture of the Compromise
When a web page includes trackpoint-async.js, the browser issues a GET request to s2.adform.net. The response is then cached locally, often for several hours, to reduce load‑time latency. This caching behavior means that once a malicious version lands in a user’s browser, the poisoned script can persist across multiple site visits, even after the provider replaces the file on its servers.
The injected payloads sit at the end of the legitimate library. Both blocks use a six‑byte XOR key to hide the replacement strings. The first block hooks the clipboard API, polling every four seconds. It watches for any string that matches known Bitcoin, Ethereum, or Tron address patterns, then swaps them out. Simultaneously, it fires an HTTP GET to 84.32.102.230:7744, appending the current page’s hostname and path as query parameters.
The second block walks the DOM, targeting input, textarea, and content‑editable elements. It rewrites matching addresses in place, then restores the cursor to avoid user suspicion. By overriding the native value setter, the code also captures programmatic writes—such as those made by wallet extensions—ensuring the malicious address persists regardless of how it is inserted.
Because the malicious code runs only while the page remains open, it leaves no lasting footprint on the host system. No binaries are dropped, and no persistence mechanisms are installed. This design keeps the attack lightweight and reduces the chance of detection by traditional antivirus tools.
What the Malicious Code Did
The injected payloads consisted of two blocks appended to the legitimate library. Both used a six‑byte XOR key to obfuscate replacement strings for the three cryptocurrency address patterns. The first block monitored the copy event, polling the clipboard every four seconds to replace matching addresses. It also fired an HTTP request to 84.32.102.230:7744 that included the current page’s hostname and path.
The second block walked the document’s text nodes, rewriting values in input, textarea, and content‑editable elements. It restored the cursor position after each rewrite and hooked the value setter so programmatic writes were altered in transit. It also intercepted copy, cut, paste, and input events, ensuring the malicious replacement persisted regardless of how the user entered the address.
That means a victim could copy a legitimate Bitcoin address, paste it into a payment form, and watch it silently change to an attacker‑controlled address before the transaction was submitted. The code operated only while the compromised page remained open; it didn’t install software or establish persistence.
Supply‑Chain Nature of the Breach
Adform’s implementation documentation states the tracking code can run on a single page, several sections, or unconditionally across an entire website. By compromising the shared trackpoint-async.js file, attackers gained a route into unrelated downstream sites without having to break each site’s defenses. That’s why the incident is classified as a supply‑chain compromise.
Supply‑chain attacks are especially concerning because they bypass traditional perimeter security. A site that trusts Adform’s script implicitly may never have its own code reviewed for malicious changes. The result: a single compromised file can jeopardize countless merchants, publishers, and advertisers.
Why the Attack Went Undetected
Beaumont noted that the file and its associated URLs, domains, and IP addresses returned no detections on VirusTotal at the time of discovery. Max Maass published a captured copy of the script on July 27, highlighting how quickly the malicious version spread. Because the script is cached by browsers, users who visited a compromised page before the fix could retain the poisoned version even after Adform removed the code from its servers.
Adform’s incident notice says technical analysis indicates the HTTP request could have transmitted the page hostname and path, but it’s unclear whether the data ever reached the attacker’s server. No evidence was found that IP addresses or other visitor information were exfiltrated.
Adform’s Response and Mitigation Steps
Adform announced the breach on July 27, 2026, stating it had removed the malicious code, notified affected clients, and reported the incident to authorities. The company urged all users to clear their browser caches to purge any lingering copies of the compromised script. It also recommended double‑checking any wallet address before sending funds.
Because the altered script could rewrite addresses entered directly into form fields, simply copying and pasting a corrected address might not be enough. Users need to verify the address after the paste operation and before confirming a transaction.
- Clear browser cache immediately.
- Inspect wallet addresses for unexpected characters.
- Monitor transactions for unauthorized transfers.
- Consider using hardware wallets that display addresses on-device.
Adform has not released indicators of compromise, nor has it identified the attacker. The company’s 2025 annual report notes its global reach but provides no specifics about how many page loads actually received the altered resource.
Open Questions and Ongoing Impact
The public timeline remains unresolved. While Adform’s notice pins the affected date to July 27, Beaumont observed malicious activity over a longer period. Without a clear reconciliation, estimating exposure is difficult.
Key unknowns include:
- How many websites incorporated the compromised script.
- How many visitors were exposed before the fix.
- Whether any funds were actually diverted.
- How the attackers gained access to Adform’s deployment path.
Until those questions are answered, the incident serves as a stark reminder that even well‑known ad‑tech providers can become vectors for crypto‑theft.
What This Means For You
Developers should treat any third‑party script as a potential attack surface. Implement Subresource Integrity (SRI) where possible, even for scripts that change frequently, and monitor the integrity hashes of critical assets. If you rely on ad‑tech, consider rotating keys and limiting the scope of scripts to only the pages that truly need them.
For anyone handling cryptocurrency payments, always verify addresses on a trusted device after pasting them. Use copy‑and‑paste warnings in UI designs, and consider adding checksum verification to catch subtle modifications. The cost of a single stolen transaction can dwarf the effort of adding these safeguards.
Going forward, the industry will need better visibility into supply‑chain changes. Real‑time alerts for script modifications could give sites a chance to react before users are exposed. Until then, vigilance remains the best defense.
What Happens Next
Adform has pledged to audit its build pipeline and tighten access controls. The company also plans to publish a set of recommended security practices for its clients, focusing on script integrity and cache management. Security researchers anticipate that third‑party monitoring services will add new rules to flag sudden changes in widely used JavaScript files.
Organizations that depend on ad‑tech should review their own incident‑response playbooks. A quick cache purge can mitigate many of the lingering effects of a compromised script. Meanwhile, wallet users are encouraged to adopt multi‑factor verification steps whenever possible.
Stakeholders will be watching for any follow‑up disclosures that clarify the scale of the breach. The hope is that transparency will drive faster remediation across the ecosystem.
Sources: The Hacker News, Max Maass
