Security researchers and Adform say hackers used a poisoned advertising script to manipulate cryptocurrency wallet addresses on users’ browsers. The behavior goes beyond typical ad fraud: the JavaScript file could rewrite Bitcoin, Ethereum, and Tron addresses at the moment someone was about to copy or submit them. That means a person may have believed they were sending funds to one address, while the page quietly replaced it with another.
Adform detected the issue on July 27, 2026, removed the malicious code, contacted affected clients, and informed authorities. Still, key questions remain open about the full scope of exposure and whether any funds were actually redirected.
What is crypto address swapping?
Crypto address swapping is a browser-side tactic where malware replaces cryptocurrency destination addresses during user interaction. In this case, the altered script targeted address patterns associated with Bitcoin, Ethereum, and Tron. If a visitor copied an address (or typed one into fields on an affected page), the script could replace the value with a different, attacker-controlled one.
What makes this incident particularly concerning is that it could operate without needing the attacker to compromise each individual website directly. By taking over a shared resource used across multiple downstream sites, attackers gained a path into many unrelated pages.
How the poisoned script worked
According to the public details, the compromised resource was a JavaScript file named trackpoint-async.js, served from s2.adform[.]net. Adform’s documentation indicates its tracking code can run on a single page, multiple sections, or even across an entire website. By compromising that shared file, attackers could influence many sites that included Adform’s implementation.
Adform states the code was not intended to install software or establish persistence. The script appears designed to operate only while an affected page remained open—so the attack’s impact depends heavily on whether a user visited a site while the malicious version was served.
Replacing addresses from clipboard and forms
The captured sample contained two malicious blocks appended to an otherwise legitimate library. The replacement strings were obfuscated with a six-byte XOR key, and the code focused on rewriting specific address formats.
The first block aimed to swap addresses via user actions. It watched for copy activity and tried to read the clipboard periodically, then replaced matching cryptocurrency addresses. It also performed an HTTP request when the page loaded, including the hostname and path of the page a visitor was on.
Importantly, clipboard copying was not the only path. The second block walked through the document text nodes and rewrote values inside input-related elements, including input, textarea, and contenteditable fields. It also restored the cursor position after rewriting. Beyond rewriting existing values, it hooked the value setter on input and textarea elements, which helped ensure programmatic updates could be intercepted and rewritten in transit.
Additionally, it intercepted user events such as copy, cut, paste, and input, increasing the chance that a user-entered address could be swapped before any submission or final confirmation.
Why supply-chain distribution matters
This incident is best understood as a supply-chain compromise at the script level. Instead of breaking into each website, attackers targeted a shared third-party component that many customer sites likely used. That design reduces the attacker’s workload and can expand impact while leaving the compromised sites unaware.
Adform’s own numbers—such as its customers, ad delivery scale, and geographic reach—describe the platform in general, not the incident’s outcome. For risk assessment, the more relevant metric would be how many actual page loads received the altered resource and during which exact time window.
What Adform says about data theft
Adform reports it found no evidence that the script transmitted visitors’ IP addresses or information about the websites they visited. At the same time, its incident notice acknowledges that technical analysis indicated such transmission may have been possible.
The first payload’s HTTP request construction included page hostname and path, which suggests the operator attempted to learn what page context the visitor was viewing. However, whether the request reached the attacker’s server—and whether it resulted in any actionable targeting—has not been definitively established by the available sample.
Timeline gaps and unresolved scope
Adform says the affected date was July 27, 2026, and it removed the malicious code after detection. Meanwhile, independent researcher Kevin Beaumont reportedly observed malicious activity via the Adform service over the prior week. Those two accounts are not yet reconciled publicly, which creates uncertainty around how long the poisoned script was actually in circulation.
There is also missing information that would help quantify impact, such as:
- How many websites included the compromised file
- How many visitors were exposed during the relevant window
- How attackers managed to reach the deployment path
- Whether any victims actually had funds diverted
- Whether Adform or downstream clients have indicators of compromise
Adform’s public notice, as described in the reporting, does not list specific indicators that can be easily used for detection on customer systems.
What you should do if you visited affected pages
If you visited a site that used the compromised Adform script on July 27 and you copied or entered a cryptocurrency address for Bitcoin, Ethereum, or Tron, take the following precautions.
First, clear your browser cache. Adform specifically advises this because the altered file could remain cached even after the fix was applied. Clearing cache helps ensure your browser loads the corrected version the next time it visits a page that relies on Adform’s resources.
Second, verify wallet addresses before sending funds. The safest approach is to confirm the destination address from a trusted source—such as the recipient’s official channel—and compare it carefully before initiating a transfer.
Third, review the timing of any recent deposits. If you sent funds around the affected period, cross-check the address you used against the address your recipient provided afterward. While the public information does not confirm actual theft, the swapping behavior creates a real risk worth addressing immediately.
What to watch for in the recovered code
The publicly captured sample provides additional insight into how the swapping occurred. The malicious functionality was not a single simple string replacement. Instead, it combined clipboard monitoring, event interception, and rewriting logic across multiple types of page elements.
Researchers also reported that the replacement addresses appeared to vary, and that the sample’s hardcoded patterns matched the relevant cryptocurrency address formats. That design supports the idea that victims could be swapped to different attacker destinations rather than a single fixed address.
Even if someone noticed an incorrect address and recopied it, Beaumont reported that the script could continue replacing the address repeatedly. That is consistent with how the code hooked copy-related behavior and value-setting operations while the page remained open.
Broader lessons for website owners and users
For site operators, this incident highlights the importance of scrutinizing third-party scripts, especially when they handle front-end functionality that can affect user input. Because the compromised file was delivered through an established advertising technology service, downstream sites may not have any visibility into what that shared resource is doing at runtime.
For users, it’s a reminder that cryptocurrency transfers are highly sensitive to client-side manipulation. If you’re relying on copy/paste from a webpage, you may be exposed to replacement behavior even when you think you followed standard steps.
Conclusion
The Adform incident described in public reporting shows how far crypto address swapping attacks can go when hackers compromise shared browser-side scripts. By modifying trackpoint-async.js, the attackers could rewrite Bitcoin, Ethereum, and Tron addresses during clipboard actions and within form fields, potentially at the critical moment funds are prepared for transfer.
Adform removed the malicious code, but users are urged to clear their browser cache and verify any wallet address before sending. Meanwhile, the full timeline, exposure count, and any confirmed financial impact remain unresolved, leaving the security community to piece together how the compromise spread and what victims experienced.
Source: https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html
