Adform's Ad Tracker Was Hijacked to Steal Crypto

You copy a wallet address. You paste it. The characters look close enough to what you copied, because you never actually read all 42 of them. The money goes to someone else. That was the entire attack, and the thing that delivered it was not a sketchy download or a phishing link. It was an advertising tag that a publisher added to their site years ago and has not thought about since.

Key Takeaways

• Adform's JavaScript tracking library trackpoint-async.js, served from s2.adform.net, was modified to carry a cryptocurrency clipper that ran inside every visitor's browser.
• Security researcher Kevin Beaumont found the injected code, which polled the clipboard every four seconds and swapped Bitcoin, Ethereum and TRON addresses for attacker controlled ones, beaconing to 84.32.102[.]230:7744.
• The oldest archived malicious sample dates to July 26, 2026; Adform detected and removed the code on July 27, 2026, and the incident became public on July 31, 2026.
• The file, its URLs, domains and IP address returned zero detections on VirusTotal at the time of discovery.
• Adform's own 2025 annual report describes roughly 1,800 customers and 1.5 billion ads served daily across more than 180 countries; no official count of affected sites or users has been published.

What Exactly Was Injected Into trackpoint-async.js?

Two obfuscated blocks of extra JavaScript were appended to the end of the legitimate library, and both of them existed to intercept cryptocurrency addresses before a human could verify them. The Hacker News reported that the first block listened for the copy event, attempted to read the clipboard every four seconds, and replaced any string matching a wallet address pattern. It also sent HTTP requests carrying the hostname and path of the page the victim was on.

The second block was the more interesting one. It walked the document's text nodes and rewrote addresses displayed on the page itself, then reached into input, textarea and contenteditable elements to swap what you had typed. It hooked value setters to catch programmatic writes, intercepted copy, cut, paste and input events, and restored your cursor position after each rewrite so nothing looked wrong. The replacement addresses were hidden behind a six byte XOR key.

Read that list of hooks again and notice what it implies. A tracking tag can do all of this because a tracking tag is not a passive beacon. It is code executing in your page's origin with the same DOM privileges as the site's own application logic.

Why Did No Antivirus Engine Flag It?

Because there was nothing on disk to scan. Beaumont noted that the file and its associated URLs, domains and IP addresses returned no detections on VirusTotal when he looked. The payload installed no software, wrote no registry keys and established no persistence. Adform confirmed the malware operated only while an affected page stayed open.

Endpoint security is built around artifacts: files, processes, persistence mechanisms. A script that lives for the lifetime of a browser tab, arrives over TLS from a domain the site owner deliberately allowlisted, and disappears on refresh produces none of those. It is the same blind spot that let a fake Perplexity extension quietly log search queries, and the reason browser resident threats keep outliving the tools meant to catch them.

Why Is One CDN Hosted File a Single Point of Failure?

Because thousands of sites fetch it fresh on every page load, so whoever controls the file controls every one of those pages at once. A publisher pastes a script tag in once. From then on, whatever bytes the vendor's CDN returns get executed, with no version pinning, no review and usually no integrity check.

This is the exact failure mode of the 2024 polyfill.io compromise, where a newly acquired domain began injecting redirects into a library embedded on more than 100,000 websites. It is also the same shape as package registry attacks, where one poisoned dependency propagates downstream in minutes rather than weeks, as happened when North Korean operators poisoned 141 npm packages in 45 minutes. Adtech simply skips the build step: there is no lockfile between the attacker and the victim's browser.

Most coverage of this incident led with the crypto theft. The theft is the least interesting part. The story is that a tag nobody audits had write access to the DOM and the clipboard, and that access was always there, waiting for someone to abuse it.

What This Means for Your Inbox

Email tracking pixels are the same category of asset: a third party resource loaded into your session without your consent, from infrastructure you have no visibility into and no relationship with. A pixel is far more limited than a full script, since it cannot execute code in the page. But the trust model is identical, and the Adform incident shows what happens when the vendor at the other end of that trust relationship loses control of their own delivery pipeline.

Marketing email routinely embeds resources from a dozen vendors you have never heard of, chosen by whichever company you bought socks from. Blocking those loads by default is the same instinct that would have protected you here: refuse third party assets you did not ask for, rather than trusting every vendor in the chain to stay uncompromised forever. Gblock does that for spy pixels in Gmail; a content blocker does it for scripts on the open web.

What Should You Actually Do?

• Verify wallet addresses character by character, not at a glance. Check the first six and last six characters after every paste, and send a small test transaction before a large transfer. Clipper malware relies entirely on you not looking.
• Run a content blocker that blocks third party scripts, not just ads. Anything that blocked s2.adform.net as an advertising domain never executed this payload. A good list is the cheapest exploit mitigation available, and the anti tracking extension landscape in 2026 has solid free options.
• Use a hardware wallet and confirm the address on the device screen. A hardware wallet displays the destination on a screen the browser cannot rewrite, which defeats DOM level address swapping outright. NIST's blockchain overview is a decent primer on why address integrity carries all the weight in an irreversible system.
• If you run a site, add Subresource Integrity or self host what you can. SRI is a browser standard that refuses to execute a fetched file whose hash does not match, and it is documented in the W3C specification. It breaks on vendors who ship rolling updates, which is precisely the category of vendor you should be most nervous about.
• Audit which extensions and tags have page access. Extensions carry the same DOM privileges as an injected script, and vendors change hands quietly, as ModHeader's 1.6 million users discovered.

The Uncomfortable Part

Adform removed the code within roughly a day, notified clients and told users to clear their browser cookies, which is a fast and reasonably transparent response by industry standards. It also did not matter much for anyone who pasted a wallet address during the window. Blockchain transactions do not have a chargeback.

The advertising industry spent twenty years convincing publishers that a tracking tag is a harmless piece of plumbing. It is not plumbing. It is arbitrary code from a third party, refreshed on every page load, running with your site's full privileges, and the only thing standing between it and your visitors is that vendor's internal security. Adform is a real company with real controls and it still happened. The correct default is to load less of this stuff, in your browser and in your inbox, and to stop treating "it's just an analytics tag" as an answer. Full technical detail on the incident is available from BleepingComputer's report.