Adform's Ad Script Hijacked to Drain Crypto Wallets

Robert Moore · 2026-07-31

You'd think a digital ad platform would be the last place a crypto thief would strike. But that's exactly what happened with Adform, one of the bigger names in online advertising. The company recently got hit with a supply-chain attack that slipped malicious code into its ad scripts. And the result? Anyone copying a cryptocurrency wallet address on a site running those ads could have accidentally pasted a hacker's address instead. Yeah, it's that sneaky. ### What Actually Happened Here's the breakdown. Adform's ad platform serves millions of impressions across countless websites. Attackers managed to compromise one of the company's scripts, which then got loaded by sites using Adform's services. Once active, the script monitored the visitor's clipboard. If you copied a wallet address—say, for a Bitcoin or Ethereum payment—the script would swap it out for one controlled by the attackers. You'd think you were sending funds to the right place, but your money would end up in a stranger's pocket. This is what security folks call a supply-chain attack. It's not that the websites themselves were hacked. The vulnerability was in the third-party tool those sites trusted. And that's the scary part—you can do everything right on your end and still get caught in the crossfire. ### Why This Matters for Crypto Users If you're into crypto, this should get your attention. The whole point of copying a wallet address is to avoid typos and ensure your funds land in the right spot. Malware that hijacks your clipboard completely undermines that safety net. You might double-check the first few characters, but if the rest of the address looks legit, most people won't catch the swap. The attackers didn't need to break into your computer or your exchange account. They just needed to get between you and your clipboard. ### How Attackers Pulled It Off The exact method is still being investigated, but the pattern is familiar. Compromised scripts often come through unsecured update channels, stolen credentials, or a vulnerability in the vendor's build process. Once the attackers got in, they injected their code into a JavaScript file that many sites loaded automatically. No user interaction required beyond visiting a page that ran the ad script. It's a quiet, low-noise attack that can run for weeks without anyone noticing. ### What You Can Do to Protect Yourself - **Verify the full address** before confirming any crypto transaction. Don't just glance at the first few characters. - **Use a hardware wallet** or a trusted app that shows the full address on a separate screen. - **Cross-check with a second source**, like a phone app or a written note, especially for large transfers. - **Keep your browser and extensions updated**, and consider disabling third-party scripts on sites you don't fully trust. - **Be wary of public Wi-Fi**, where clipboard hijacking and other man-in-the-middle tricks are easier to pull off. ### The Bigger Picture for Digital Privacy This incident isn't just about crypto. It's a reminder that the tools we rely on every day—ad networks, analytics scripts, even font loaders—can become attack vectors. For anyone serious about online privacy, this reinforces the value of using antidetect browsers and other tools that isolate your browsing sessions. These browsers can help block or sandbox third-party scripts, making it harder for malicious code to run in the first place. > "The weakest link in your security chain isn't your password or your VPN. It's the trust you place in every third-party script your browser loads without asking." The Adform attack is a wake-up call. It shows that even established companies can be compromised, and the fallout can affect anyone who visits a site using their services. So next time you copy a wallet address, take that extra second to verify it. And if you're running a business that relies on third-party ad scripts, now might be a good time to audit your supply chain.