**Adform**, a prominent advertising technology company, recently confirmed a supply chain compromise that saw attackers inject malicious JavaScript into a widely deployed tracking script. The incident, detected on July 27, 2026, transformed `trackpoint-async.js` into a browser-side tool capable of silently altering cryptocurrency wallet addresses. ### The Mechanics of the Attack The compromised script specifically targeted **Bitcoin**, **Ethereum**, and **Tron** addresses. Users who visited websites integrating the affected **Adform** script and attempted to copy or input a cryptocurrency address might have inadvertently pasted a different, attacker-controlled address. **Adform** has stated that the malicious code did not establish persistence or install software, operating only while an affected page remained open. However, it was capable of rewriting addresses entered directly into form fields, not just those copied to the clipboard. ### Incident Response and Discrepancies Upon detection, **Adform** promptly removed the malicious code, notified affected clients, and reported the incident to authorities. The company has advised users to clear their browser caches and to meticulously verify wallet addresses before initiating any cryptocurrency transfers. While **Adform**'s official notice pinpoints July 27 as the affected date, independent security researcher **Kevin Beaumont** reported observing malicious activity via **Adform** over a longer period. This discrepancy leaves the full timeline of exposure unresolved. ### Supply Chain Vulnerability Exploited The `trackpoint-async.js` script, served from `s2.adform[.]net`, is a shared resource that **Adform** clients can deploy across single pages, specific sections, or entire websites. By compromising this central resource, attackers gained a broad reach into numerous downstream sites without needing to breach each one individually, exemplifying a classic supply chain attack. **Beaumont**, who first publicly disclosed the compromise, noted the script's aggressive nature: "Even if you notice the address is wrong and recopy the wallet, it keeps replacing it." At the time of his report, the malicious file and its associated indicators showed no detections on **VirusTotal**. Security researcher **Max Maass** published a captured copy of the script on July 27.  ### Technical Analysis of the Malicious Script The captured sample reveals two obfuscated malicious blocks appended to the legitimate **Adform** library. These blocks use a six-byte XOR key for obfuscation. 1. **Clipboard Monitoring and Replacement**: The first block actively monitors for copy events, attempting to read the clipboard every four seconds to identify and replace matching cryptocurrency addresses. 2. **Form Field Manipulation**: The second block traverses the document's text nodes, rewriting values in input, textarea, and contenteditable elements. It also hooks the value setter for input and textarea elements, ensuring programmatic writes are intercepted and altered. Additionally, it intercepts copy, cut, paste, and input events. Both blocks contained hardcoded replacement strings for **Bitcoin**, **Ethereum**, and **Tron** address patterns, though **Beaumont** observed that the replacement addresses appeared to vary. ### Data Exfiltration Concerns While **Adform** stated it found no evidence that the code transmitted visitors' IP addresses or website visit information, their incident notice acknowledged that "Technical analysis indicates that such transmission may have been possible." The first payload's design included an HTTP request to `84.32.102[.]230:7744` on page load, intended to send the page hostname and path. Whether this data successfully reached the attackers remains unconfirmed by the sample itself. ### Unanswered Questions and Broader Impact Significant details regarding the attack remain undisclosed, including the total number of affected websites, the precise number of exposed visitors, the method by which attackers compromised **Adform**'s deployment path, and whether any funds were successfully diverted. The discrepancy in the attack's duration between **Adform**'s statement and **Beaumont**'s observations further complicates an accurate assessment of the exposure. **Adform**'s public incident notice has not yet provided any indicators of compromise. **Adform**'s 2025 annual report highlighted its extensive reach, serving approximately 1,800 customers and enabling 1.5 billion ad displays daily across over 180 countries. While these figures illustrate the platform's scale, the specific number of page loads that received the altered malicious resource has not been published. The identity of the attacker also remains unknown.