Adform Script Hijack: How Hackers Rewrote Crypto Wallets on Live Sites

Michael Miller · 2026-08-01

Here's a scenario that should make anyone in digital advertising sit up straight. On July 27, 2026, attackers quietly modified a JavaScript file served by Adform, a major advertising technology company. That single change turned a routine script into a browser-side weapon that rewrote cryptocurrency wallet addresses in real time. If you visited any site carrying that affected script on that day and copied a Bitcoin address, there's a real chance the address you got wasn't the one you intended to send funds to. That's not a hypothetical risk—it's what happened, and it's worth understanding exactly how this kind of attack unfolds and what it means for your own security. ## What Exactly Happened? Adform detected the incident on July 27, 2026. The company moved fast: it removed the malicious code, notified affected clients, and reported the breach to authorities. But the damage window was real. For anyone on those sites during that period, the script was actively rewriting clipboard content—specifically, swapping out copied cryptocurrency wallet addresses with ones controlled by the attackers. This is a classic supply-chain attack, but with a twist. Instead of targeting a single website or a single user, the attackers went after a third-party script that many sites rely on. By poisoning that one file, they essentially got a foothold in every site that loaded it. ### Why Target Crypto Wallets? Crypto transactions are irreversible. Once you send Bitcoin or any other cryptocurrency to an address, there's no chargeback, no reversal, no customer support line to call. That makes wallet addresses a prime target for attackers who want quick, untraceable payouts. The technique itself is simple but devastatingly effective. When you copy a wallet address, the malicious script intercepts that action and replaces it with a different one. You paste what you think is the right address, but you're actually sending funds straight to the attacker. ## The Bigger Picture: Why This Matters for You This incident isn't just a warning for crypto users. It's a reminder that the websites you trust are only as secure as the third-party scripts they load. Ad networks, analytics tools, and even seemingly innocuous tracking pixels can become attack vectors if they're compromised. Here's what you should take away from this: - **Always double-check wallet addresses** before sending crypto, especially large amounts. Compare the first and last few characters manually. - **Use a hardware wallet** or a trusted wallet app that verifies addresses on-device. - **Be wary of short URLs** or auto-filled addresses that come from clipboard data. - **Keep your browser and extensions updated**—many malicious scripts exploit known vulnerabilities. ### What Adform Did Right While the attack itself was concerning, Adform's response was a good example of incident handling. They detected the issue, acted quickly to remove the malicious code, and were transparent with affected clients. That's the kind of response that helps mitigate damage and rebuild trust. But it also highlights a broader issue: even well-established companies can be compromised. No one is immune, and that's why individual vigilance matters. ## What Should You Do Now? If you were on any site using Adform's script on July 27, 2026, and you copied a crypto address, it's worth reviewing your transaction history. If you sent funds to an address you didn't recognize, that's a red flag. Contact your wallet provider or exchange immediately. For the rest of us, this is a wake-up call. The internet is full of moving parts, and not all of them are safe. Stay cautious, verify addresses, and never assume a website is completely secure just because it looks professional. ### Final Thoughts This attack shows how creative and persistent hackers can be. They'll find the weakest link in the chain, whether it's a single website or a global ad platform. The best defense is a combination of good hygiene, awareness, and a healthy dose of skepticism. So next time you copy a wallet address, take that extra second to verify it. It might just save you from sending your hard-earned crypto into the void.