Adform Script Hack Alters Crypto Wallets on Hungarian Sites

A subtle but potent reminder of the fragility of our digital ecosystem landed last week, emerging not from a direct breach of a crypto exchange, but from a compromised piece of advertising code. The incident, involving a widely-used script from ad tech firm Adform, temporarily turned countless website browsers into unwitting accomplices in a sophisticated cryptocurrency redirection scheme.

On July 27, 2026, Adform detected and removed malicious code injected into one of its JavaScript files, specifically trackpoint-async.js. This script, served from its primary domain, is a common tool used by websites to manage ad tracking and analytics. Its very purpose – to run seamlessly across countless pages – became its vulnerability. By compromising this single, shared resource, attackers gained a backdoor into a potentially vast number of unrelated websites that rely on Adform’s services, a classic example of a software supply-chain attack.

The mechanics of the hack were deceptively simple in goal but technically nuanced in execution. Security researcher Kevin Beaumont, who first brought widespread attention to the issue, described a persistent and alarming behavior. “Even if you notice the address is wrong and recopy the wallet,” he wrote, “it keeps replacing it.” The malicious code, appended to the legitimate Adform library, operated in two primary ways.

• Monitored the user’s clipboard
• Replaced cryptocurrency wallet addresses with attackers’ addresses
• Obfuscated replacement addresses using a simple XOR key
• Rewrote addresses displayed in input fields and text areas
• Hooked into the programming logic of website elements
• Checked the clipboard contents every four seconds

First, it monitored the user’s clipboard. If a visitor to an affected site copied a Bitcoin, Ethereum or Tron wallet address – perhaps from a legitimate exchange or invoice – the script would intercept that action. Every four seconds, it checked the clipboard’s contents and, if it matched a cryptocurrency address pattern, replaced it with one of the attackers’ choosing. The replacement addresses were obfuscated within the code using a simple XOR key, and Beaumont noted they appeared to vary, suggesting a dynamic targeting system.

Second, and more insidiously, the code didn’t just rely on the clipboard. It also actively walked through the text of the webpage itself, rewriting addresses displayed in input fields, text areas and any editable content. It even hooked into the programming logic of these elements, meaning addresses set by other website scripts could be altered in real-time before the user ever saw them. This dual approach – targeting both the user’s direct actions and the page’s underlying data – made the attack particularly difficult to spot and circumvent while a compromised tab remained open.

A concerning detail within the captured code sample, published by researcher Max Maass, was a call to an external server (84.32.102[.]230:7744) that included the hostname and path of the page the visitor was on. While Adform stated in its incident notice that it found “no evidence that the code transmitted visitors’ IP addresses or information about websites they visited,” it cautiously added that “technical analysis indicates that such transmission may have been possible.” This data could have helped the attackers understand which high-traffic financial or e-commerce sites were successfully serving their malicious script, potentially refining their campaign.

The true scale of the incident remains shrouded in uncertainty, creating a significant challenge for risk assessment. Adform’s public statement confines the malicious activity to July 27, 2026. However, Kevin Beaumont reported observing related malicious activity over the preceding week. This unresolved timeline gap makes any estimate of user exposure largely indefensible.

Furthermore, while Adform’s 2025 annual report boasts a platform serving 1.5 billion ads daily for 1,800 customers across 180 countries, these figures describe its entire global operation, not the specific subset affected by this compromise. The critical metric – how many page loads actually received the altered trackpoint-async.js file – has not been disclosed by the company. The number of downstream websites impacted is also unknown, as is the ultimate question of whether any funds were successfully diverted to the attackers’ wallets.

Adform has advised users who visited sites carrying its ads on the affected date to clear their browser caches, as the malicious file could persist locally even after being fixed on the server. The most crucial advice, however, extends far beyond this single incident: always double-check, even triple-check, a cryptocurrency wallet address against its source before confirming any transaction. Visual inspection is no longer sufficient; one must verify that the pasted address matches the intended one after it has been pasted.

This event underscores a pervasive risk in today’s web. Our browsing experience is built on a complex lattice of third-party scripts and services, each a potential point of failure. As Beaumont noted, the malicious file and its associated network indicators returned no detections on VirusTotal at the time of discovery, highlighting how such live-web, fileless threats can easily evade traditional security scanners. The attack didn’t need to install malware or establish a persistent foothold on a user’s machine; it simply needed a browser tab open on a reputable site. In the seamless, automated world of modern web monetization, that thin sliver of opportunity was enough.