Attackers modified a JavaScript file served by online advertising platform Adform and turned it into a browser-side tool that rewrites cryptocurrency wallet addresses on payment pages across its customers’ sites. The compromised resource, trackpoint-async.js, was served from the s2.adform[.]net domain, and the campaign was detected on July 27, when Adform removed the malicious code, notified affected clients, and reported the incident to authorities.
Anyone who visited a site carrying the affected script on that day and copied a Bitcoin, Ethereum, or Tron address may have pasted an attacker-controlled address instead. Researcher Kevin Beaumont publicly disclosed the compromise, warning that even a user who notices an address is wrong and recopies a wallet will find the script replacing it again.
How trackpoint-async.js Became a Wallet-Address Rewriter
The malicious version appends two additional blocks to the legitimate advertising library, with the extra code obfuscated by a six-byte XOR key. The first block watches copy events and reads the clipboard every four seconds, replacing any address that matches a target pattern. The second walks the document’s text nodes, rewrites values in input, textarea, and contenteditable fields, hooks the value setter, and intercepts copy, cut, paste, and input events.
The Callback to Host 84.32.102[.]230:7744 With Page Details
The first payload attempts an HTTP request to the address 84.32.102[.]230:7744 carrying the hostname and path of the page where it ran. That callback gives the operators a map of which customer sites were visited and when, even as the clipboard replacement itself does the damage.
A Shared Deployment Path and the Supply-Chain Reach
Because the compromised resource was served across a shared deployment path, the attack gave its operators a route into unrelated downstream sites without breaching each one individually. That structure is the defining feature of a supply-chain compromise: one infected file, distributed widely, reaches many victims through a single point of trust.
Detection, Disclosure, and Missing Indicators
Max Maass published a captured copy of the script on the day Adform detected the incident, and Beaumont reported no VirusTotal detections for the file or its associated URLs, domains, and IPs at the time. Adform said it found no evidence the code transmitted visitors’ IP addresses, though its technical analysis indicated such transmission may have been possible. The company’s 2025 annual report cites roughly 1,800 customers, 1.5 billion ads daily, and reach across more than 180 countries, but the number of exposed page loads during the incident window was not published, and indicators of compromise were not released.
The Lasting Risk for Visitors Who Copied Addresses
Adform advises visitors to clear their browser cache and verify wallet addresses before sending funds. The caution is aimed at a real gap: cached copies of the poisoned file may persist after the fix, continuing to rewrite addresses for users who do not clear their cache before making a payment. Because third-party ad tags are loaded from a shared edge in most sites, a visitor has no way to know which deployment path to distrust, which leaves cache clearing and address verification as the only user-side defenses after the fact.
The attack’s lasting impact may be felt beyond the immediate exposure window. Wallet addresses are routinely reused across exchanges and trading platforms, and clipboard hijacking exploits the moment of least scrutiny in a transaction. Because the malicious payload intercepted the copy action itself, a user’s own record of the copied address cannot be trusted for the affected period, and neither can transactions initiated from cached pages. The episode also points to a structural feature of the digital advertising economy: a single shared JavaScript, responsible for carrying ads across thousands of downstream sites, is a single point of failure for every page that depends on it, and the trust boundary around that script is only as strong as the access controls protecting the deployment path that was used to modify it.
