Poisoned Adform ad script swapped crypto wallet addresses on customer sites

Attackers compromised a widely used tracking script from advertising firm Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. The malicious code was appended in obfuscated form to Adform's trackpoint-async.js library, served from the company's own infrastructure, so any site loading it ran the altered script in visitors' browsers. It swapped Bitcoin, Ethereum, and Tron addresses both in the clipboard and in form fields, redirecting transfers to the attacker. Adform detected and removed the code on July 27 and says it did not install software or persist after a page closed, but cached copies may linger. It has not said how many page loads were affected.

Check

Warn people who sent cryptocurrency after visiting sites recently to clear their browser cache and verify every wallet address, and review whether your own sites embed third-party scripts that could be poisoned.

Affected

Anyone who copied or entered a crypto wallet address on a site loading Adform's tracking script on July 27; the swapped address silently redirected funds, and cached copies may still be active.

Fix

Limit and monitor third-party scripts, use subresource integrity where possible, isolate payment and wallet pages from ad and tracking code, and treat any shared external script as a single point of compromise.