Adform Script Rewrites Crypto Wallet Addresses on July 27

Adform, a major advertising technology company that serves JavaScript code to thousands of websites, discovered on July 27, 2026 that attackers had modified its core tracking script. The altered file turned into a browser‑side tool that automatically rewrites any embedded cryptocurrency wallet address before it is displayed to visitors. Adform removed the malicious code, notified affected clients and reported the incident to authorities ¹.

The attack targeted generic cryptocurrency wallet addresses. Anyone who visited a site carrying the infected script on July 27 and copied an address would actually receive a different address controlled by the attackers. The exact number of impacted users remains unknown.

Experts note this incident mirrors earlier supply‑chain compromises where malicious code injected via banner ads redirected exchange users to phishing pages. In early 2026 similar malvertising tactics targeted exchanges, leveraging ad networks’ reach to deliver client‑side exploits without direct interaction with user endpoints. Such incidents underscore how third‑party scripts can become vectors for privacy breaches when their integrity isn’t rigorously verified.

For wallet owners, the lesson is clear: always verify addresses manually and consider using hardware wallets that do not rely on third‑party web scripts for address display. For site operators, a hardened approach involves isolating ad scripts from critical page elements, employing subresource integrity checks, and maintaining tight version control over all served assets.

The broader implication extends beyond Bitcoin. Any blockchain application embedding addresses into webpages—whether for Ethereum tokens or other cryptocurrencies—is vulnerable if it relies on externally sourced scripts. As supply‑chain attacks grow more sophisticated, industry stakeholders must adopt layered defenses: script whitelisting, continuous runtime integrity verification, and coordinated incident response across vendors.

In sum, the July 27 Adform compromise demonstrates how even well‑established advertising networks can be weaponized against online privacy by rewriting fundamental data presented to users. It serves as a reminder that trust in digital ecosystems hinges on rigorous security practices at every layer—from firmware to third‑party code delivery.