Compromised Adform Script Replaced Crypto Wallet Addresses on Customer Sites
On July 27, 2026, advertising technology company Adform detected malicious code in trackpoint-async.js, removed it, notified affected clients and reported the incident to authorities. The altered JavaScript replaced Bitcoin, Ethereum and Tron wallet addresses on customer websites, including addresses entered directly into form fields.
Why the shared script created systemic risk
Adform's tracking code can run on a single page, across selected sections or throughout an entire website. Compromising that shared resource therefore gave the attackers access to unrelated downstream sites without requiring a separate breach of each organization.
The payload installed no software and established no persistence. It operated only while an affected page remained open, but one altered address at the moment of payment could redirect an irreversible transfer. Cached copies may also remain after the server-side fix.
How the address replacement worked
A captured sample contained two malicious blocks appended to the legitimate library, with replacement strings hidden using a six-byte XOR key. One block monitored copy activity and attempted to read the clipboard every four seconds. The other traversed page text and rewrote values in input, textarea and contenteditable elements.
“Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.”
The code also intercepted copy, cut, paste and input events, while hooks on form-value setters altered programmatic writes. One payload attempted to send the page hostname and path to an external server. Adform found no evidence that visitor IP addresses or browsing information were transmitted, although its analysis said transmission may have been possible.
The exposure window remains disputed: Adform identified July 27, while security researcher Kevin Beaumont reported activity over the preceding week. The company has not published the number of affected sites, visitors or page loads, and no diverted funds have been confirmed. The attacker and initial access method are also unknown.
The case adds a browser-side example to the growing risk of software supply-chain attacks, showing how one trusted deployment path can expose otherwise unrelated businesses. Companies should inventory third-party scripts, monitor them for unexpected changes, clear affected caches promptly and require cryptocurrency addresses to be verified through a separate channel before authorizing payment.
What the Adform security incident means for website operators
Searches for the Adform breach, Adform crypto attack or compromised trackpoint-async.js refer to the same reported incident: malicious code was appended to a shared advertising script and could replace cryptocurrency wallet addresses in page content and form fields.
Was Adform breached or was its script compromised?
Adform reported detecting and removing malicious code from trackpoint-async.js on July 27, 2026. Calling it an Adform breach may imply more than the available information confirms: the initial access method, attacker and full exposure period remain unknown. What is established is that a trusted shared script was altered and then executed on customer websites that loaded it.
- The payload targeted Bitcoin, Ethereum and Tron wallet addresses.
- It could rewrite visible text and editable form values.
- It also monitored clipboard-related and input events.
- No diverted funds or total number of affected sites were confirmed.
Checks for sites that loaded trackpoint-async.js
The immediate task is to determine where and when the Adform script was present, remove any affected cached copies and review workflows involving cryptocurrency addresses. Because replacement occurred in the browser, checking only stored website or form data may not reveal what a visitor saw before submitting a payment.
- Inventory every page or section that loaded the shared script.
- Clear cached copies of the affected JavaScript under your control.
- Review relevant payment records and browser-side evidence where available.
- Verify cryptocurrency destination addresses through a separate channel.
- Monitor third-party scripts for unexpected changes.
Frequently asked questions
What happened in the Adform security incident?
Malicious code was appended to Adform's trackpoint-async.js library. When an affected page was open, the code could replace supported cryptocurrency wallet addresses in page text, clipboard interactions and editable fields.
Was Adform compromised?
Adform confirmed that malicious code was present in its shared tracking script and removed it. The available information does not establish how the attacker gained access or the full scope of the compromise.
Did the Adform crypto incident result in stolen funds?
No diverted funds had been confirmed in the reported information. The number of affected sites, visitors and page loads was also not published.
Could trackpoint-async.js remain risky after removal?
Cached copies could remain temporarily after the server-side fix. Website operators should clear affected caches they control and confirm that pages no longer load the altered file.
How can a crypto address be checked before payment?
Compare the complete destination address through a separate trusted channel rather than relying only on copying it again from the same open page.