"Even if you notice the address is wrong and recopy the wallet, it keeps replacing it," wrote Kevin Beaumont, an independent security researcher who disclosed the compromise. The warning describes a targeted manipulation of cryptocurrency addresses that turned a widely distributed advertising script into a real‑time wallet‑swapping tool.
How the malicious JavaScript operated
Attackers appended two malicious blocks to Adform's legitimate trackpoint-async.js library. The injected code used a six‑byte XOR key to obfuscate replacement strings and contained hardcoded patterns for Bitcoin, Ethereum, and Tron addresses. One block watched for copy events, probed the clipboard every four seconds, and attempted an HTTP request on page load to 84.32.102[.]230:7744 that included the page hostname and path. The second block walked the document's text nodes, rewrote values in input, textarea, and contenteditable elements, restored cursor position after a rewrite, and hooked the value setter on input and textarea elements so programmatic writes were rewritten in transit. Both blocks intercepted copy, cut, paste, and input events. Beaumont reported that the replacement addresses appeared to vary.
Where the compromise lived: trackpoint-async.js on s2.adform.net
The compromised resource was trackpoint-async.js, served from s2.adform[.]net. Adform's implementation documentation says the tracking code can run on one page, several sections, or unconditionally across an entire website; compromising that shared resource gave attackers a route into unrelated downstream sites without breaching each one separately. The shared deployment path makes this a supply‑chain compromise. While an affected page remained open, a single altered address at the point of payment could redirect a transfer.
Adform's detection, remediation, and public statements
Adform says it detected the incident on July 27, removed the malicious code, notified affected clients, and reported the matter to authorities. The company advised people to clear their browser cache because the altered file may remain cached after the fix, and to check any wallet address before sending funds. Adform additionally stated the code "was not designed to install software or establish persistence and operated only while an affected page remained open." The company reported finding no evidence that the code transmitted visitors' IP addresses or information about visited websites, but its notice added that "Technical analysis indicates that such transmission may have been possible."
Discovery, captured sample, and early forensic signals
Beaumont disclosed the compromise and said he observed malicious activity via Adform over the prior week, a window that does not fully align with Adform's July 27 affected‑date statement. Max Maass published a captured copy of the script on July 27. Beaumont also reported that the file and related URLs, domains, and IP addresses returned no detections on VirusTotal at the time he checked. Adform's public incident notice lists no indicators of compromise and the company has not publicly identified the attacker.
Scope, missing facts, and open exposure questions
Key elements of scope remain unresolved. Adform has not published how many websites carried the altered resource, how many page loads served the compromised file, how many visitors were exposed, how the attackers gained access to Adform's deployment path, or whether any funds were diverted. Adform's 2025 annual report — cited in its public materials — notes roughly 1,800 customers, 1.5 billion ad displays daily, and ad activity in more than 180 countries during 2025, but those platform figures describe capacity, not the number of page loads that actually received the altered resource.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: a shared third‑party script running site‑wide can transform a single compromise into a cross‑site vector; the injected code's hooking of setters and interception of input events shows that clipboard checks alone do not prevent runtime replacements.
- Affected enterprises and procurement leaders: because the tracking library can run unconditionally across sites, organizations relying on externally hosted tags should verify deployment patterns, caching behavior, and incident notification practices for critical third‑party vendors.
- End users and cryptocurrency senders: Adform's advisory is explicit — clear your browser cache where a compromised file might remain, and verify any wallet address immediately before sending funds; the sample captured by researchers rewrote addresses entered directly into form fields, so copying the address is not the only failure mode.
Adform removed the malicious code and notified clients, but the fundamental question the record still leaves open is straightforward: how many payments, if any, were redirected before the fix? With no published page‑load count for the altered resource and no indicators of compromise released, that question remains unanswered.
