Adform script swapped cryptocurrency wallet addresses on websites

Adform has disclosed an incident in which some scripts delivered to customers contained an unauthorised modification. Malicious JavaScript running in the context of a visited page searched for Bitcoin, Ethereum and TRON wallet addresses and replaced them with values controlled by the attacker.

The mechanism required neither a browser extension nor malware installed on the device. Visiting a page that loaded the altered resource at that time was enough. This is a frontend supply-chain problem: a site’s first-party code may be sound while a third-party script receives the same access to the DOM as the application itself.

What is known

In its security incident update, Adform says it detected the event on 27 July, removed the unauthorised code, began an investigation and notified customers. The company describes unauthorised manipulation of a JavaScript component served through its infrastructure.

Analysis of a public sample points to trackpoint-async.js served from s2.adform.net. The code looked for cryptocurrency-address patterns in several places:

• the clipboard during copy and paste;
• input and textarea fields;
• contenteditable elements;
• text nodes on the page.

Adform says it found no evidence that IP addresses or visited sites were transmitted to the attacker. It also notes that the modified JavaScript was technically able to make external requests. That is an important boundary between observation and capability: “no evidence found” does not mean “the code lacked that ability.”

The full number of exposed sites, the initial access path, the value of affected transactions and the responsible actor have not been established publicly.

How address replacement works

A wallet address is a long string that people rarely validate character by character. An attacker exploits that process weakness:

1. the user copies the correct recipient address;
2. the script recognises the cryptocurrency format;
3. it replaces the value with an attacker-controlled address;
4. the user sees a similar-looking string and approves the transaction;
5. the blockchain correctly executes an irreversible transfer — to the wrong recipient.

Modification inside forms and the DOM expands the risk beyond the clipboard. An address can change after it is pasted, when focus moves between fields or even inside visible payment instructions. Checking only that the clipboard once contained the expected value may therefore be insufficient.

Why third-party JavaScript is highly privileged

A script loaded through a <script> element normally runs as part of the page rather than as an isolated supplier resource. It can read and modify the DOM, intercept events, use the site’s active session and make requests within browser controls.

An advertising or analytics tag is therefore a production dependency with influence comparable to application code. The list of these resources is not merely a marketing or performance concern; it belongs in the software inventory.

Risk is particularly high on sites where a user:

• copies payment identifiers;
• enters financial data;
• works inside an authenticated console;
• can access internal information;
• makes decisions based on DOM-generated content.

What site owners should do

First determine whether and when the Adform resource was used:

• search source code, the tag manager, templates and header configuration;
• inspect deployment history rather than only the current release;
• review CSP reports, proxy data and browser RUM telemetry;
• establish the pages and countries where the tag was active;
• identify whether those pages contain wallet addresses or payment forms.

Remove any local copy of the altered resource, clear CDN caches and confirm users are not receiving an old response from browser cache. Adform recommends clearing browser caches. Managed environments can also force affected tabs to close or restart the browser.

If the site supports cryptocurrency payments, notify users in a way that does not train them to click an arbitrary link. Ask them to review transaction history and compare the complete address with a value obtained through an independent channel.

Controls for the next incident

Content Security Policy. Maintain the smallest practical set of allowed script sources. CSP cannot save a page where the compromised host is already allowlisted, but it can constrain further code loading and outbound requests. Design connect-src as carefully as script-src.

Subresource Integrity. SRI allows a browser to verify the hash of a static script. It does not fit a resource that the supplier changes frequently and automatically unless the organisation pins a version. That inconvenience exposes the real choice: seamless supplier updates or controlled change after verification.

Isolation. Where a function can operate in a separate frame without sensitive-DOM access, use a sandboxed iframe and minimum permissions. Not every advertising tag supports this pattern, but suppliers should have to justify access to the entire page.

Change monitoring. Inventory the URL, hash, business owner, purpose and last review for each external script. Alert on a new domain, changed behaviour, access to sensitive fields or unexpected egress.

Safer cryptocurrency payments

Website controls do not replace transaction controls. Before signing:

• compare the full address, or at least long beginning and ending segments;
• display the address on the hardware signing device;
• verify a new recipient through an independent authenticated channel;
• send a small test transaction before a high-value transfer;
• use an approved recipient book and multi-person authorisation;
• check the value again after pasting and immediately before signing.

Validating only the first and last four characters is better than no check, but it is not ideal. Attackers can generate lookalike addresses. High-value payments need a stronger process.

Detection and investigation scope

Preserve copies of the script response, headers, hashes and observation timestamps. Search proxy and browser records for downloads from the affected domain and subsequent outbound connections. Finance teams should review transactions during the exposure window, especially new addresses and mismatches with invoices or tickets.

An organisation that makes no cryptocurrency transactions has less exposure to the direct theft mechanism in the sample, but that is not proof of no risk. Page-level JavaScript can interact with data visible in the DOM; assessment should use the preserved script version and the actual affected page.

Primary facts versus Breachroad analysis

Adform confirms the unauthorised JavaScript change, its remediation, the lack of evidence found for transmission of IP and site data, and the technical ability to make external requests. Public sample analysis confirms replacement logic for BTC, ETH and TRON addresses.

Breachroad’s process conclusion is that third-party code needs an owner, inventory, privilege assessment and disconnection plan. “Marketing tag” is not a lower-trust browser category — without isolation, it executes as part of the application.

Cybersecurity training for IT, marketing and finance teams helps staff identify supplier risk and verify payments. An IT security audit can assess CSP, tag management, external scripts, change monitoring and incident response.