How a Single Script Hijacked Crypto Wallets on Major Ad Sites

Michael Miller · 2026-08-01

It’s the kind of story that makes you want to double-check every extension you’ve ever installed. On July 27, 2026, hackers managed to pull off something that sounds almost too sneaky to be real. They didn’t break into a crypto exchange or a wallet app. Instead, they went after something far more mundane: a JavaScript file served by Adform, a major advertising technology company. That single file became a weapon. Once it loaded on a website, it quietly rewrote cryptocurrency wallet addresses right in the user’s browser. If you copied a Bitcoin address to send a payment, the script could swap it for one controlled by the attackers. No malware download, no phishing page. Just a silent, in-browser edit that could redirect your funds. ### What Exactly Happened? Adform detected the breach on July 27, 2026. They acted fast, removing the malicious code and notifying affected clients. They also reported the incident to authorities. But the damage window was real. Anyone who visited a site carrying the affected script that day and copied a Bitcoin address could have been hit. Here’s the scary part: this wasn’t a hack of a single website. It was a supply chain attack. By compromising a third-party script that many sites rely on, the attackers effectively multiplied their reach. One poisoned file, dozens or even hundreds of sites affected. ### Why This Matters for Anyone Using Crypto If you’ve ever copied a wallet address from a webpage, you know how easy it is to trust what you see. You highlight, copy, paste, and hit send. This attack exploits that exact moment of trust. The script didn’t need to steal your password or trick you into a fake login. It just needed to change a string of characters you were about to paste. That’s why this feels different from a typical phishing scam. It’s not about getting you to click something suspicious. It’s about tampering with the very tools you use to verify transactions. And it happens entirely in the background, with no visible sign that anything is wrong. ### What Can You Do to Protect Yourself? This kind of attack is hard to spot, but there are habits that can make you a much harder target: - **Always verify the full wallet address** before sending. Don’t just check the first few characters. Compare the entire string with a trusted source. - **Use a hardware wallet** when possible. It adds an extra layer of verification before any transaction goes through. - **Avoid copying addresses from websites altogether.** Instead, send a small test amount first, then confirm the recipient received it before sending the full amount. - **Keep your browser and extensions updated.** While this attack targeted a third-party script, outdated software can make you more vulnerable to other exploits. ### The Bigger Picture: Supply Chain Risks This incident is a reminder that the internet runs on trust. We trust ad networks, analytics tools, and countless other third-party services to do their job without interfering. But when one of those services gets compromised, the ripple effect can be massive. For businesses, this is a wake-up call to audit the scripts you load on your site. Do you really need that third-party widget? Could it be hosted internally? Each external script is a potential entry point for attackers. For everyday users, the takeaway is simpler: don’t assume the page you’re looking at is safe just because it looks normal. The code running underneath can be doing all sorts of things you can’t see. ### Final Thoughts Adform’s response was quick, and that’s commendable. But the incident highlights a growing trend in cybercrime: attacking the infrastructure we all rely on, rather than individual targets. It’s easier, more scalable, and often goes unnoticed until it’s too late. If you were on any site with the affected script on July 27, it’s worth reviewing your recent transactions. And even if you weren’t, this is a good moment to build better habits. A few extra seconds of verification could save you from losing a whole wallet. Stay sharp out there. The bad guys are getting creative, but so can we.