Adform's Ad Script Hack Just Swapped Crypto Wallets on Millions of Sites

Emily Davis · 2026-07-31

Here's a scenario that should make every digital marketer and crypto user sit up straight: you copy a wallet address to send a payment, paste it into your wallet app, and hit send. The funds go through, but they land somewhere entirely different than you intended. That's exactly what happened to visitors of websites using Adform's advertising platform. Adform, a major online advertising firm, suffered a supply-chain attack in which malicious code was injected into its ad scripts. This attack didn't just collect data or show pop-ups. It actively replaced cryptocurrency wallet addresses copied to a visitor's clipboard with addresses controlled by the attacker. If you copied a wallet address to make a payment, the script quietly swapped it for a different one. And if you didn't double-check the address before confirming the transaction, your funds went straight into a stranger's pocket. ### What Is a Supply-Chain Attack, Anyway? Think of it like this: you hire a trusted contractor to install a security system in your office. They do a great job, but a few weeks later, you find out that one of their workers had a master key and was secretly letting thieves in through the back door. You didn't do anything wrong. Your team didn't do anything wrong. But the one weak link in the chain compromised everything. That's what happened here. Adform wasn't hacked directly in the sense of losing data. Instead, a third-party script or component they used was compromised, and that tainted code was then served to all the websites running Adform's ads. It's a single point of failure that can affect thousands of sites at once. ### Why This Matters for You If you run a website that uses ad networks, or if you're a crypto user who shops online, this attack should be a wake-up call. Here's why: - **Clipboard hijacking is sneaky.** You don't see it happening. You copy an address, and the script swaps it before you paste it. It's silent, instant, and invisible. - **It's not just ad networks.** Any third-party script on your site could be compromised. Analytics, chatbots, payment forms, and even font loaders are all potential entry points. - **The damage is hard to reverse.** Once crypto is sent to the wrong address, there's no chargeback, no fraud department, and no way to recover it. It's just gone. ### How to Protect Yourself Right Now There are a few practical steps you can take, both as a website owner and as a crypto user. **If you're a site owner:** - Audit every third-party script you load. If you don't know what it does, remove it. - Use subresource integrity (SRI) checks whenever possible. This ensures the script hasn't been tampered with. - Consider using a content security policy (CSP) to restrict which scripts can run on your pages. **If you're a crypto user:** - Always verify the full wallet address before sending, especially the first few and last few characters. - Use a hardware wallet or a trusted wallet app that shows you the address on a separate screen. - Double-check the address on the receiving end before confirming. It takes two seconds and can save you thousands of dollars. ### The Bigger Picture This attack on Adform is just one example of a growing trend. Cybercriminals are moving away from hacking individual users and toward compromising the tools and services those users rely on. It's a more efficient way to reach millions of people at once. And because it happens at the infrastructure level, it's much harder to detect. So what can you do? Be skeptical. Don't assume that because a website looks legitimate, every script running on it is safe. And for crypto transactions, always take that extra moment to verify. It might feel like overkill, but in a world where one wrong click can empty your wallet, a little paranoia goes a long way.