Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites

Summary

Hackers compromised Adform's JavaScript, altering cryptocurrency wallet addresses on client sites. Adform detected and removed the malicious code on July 27, 2026, and notified authorities and clients. The attack rewrites addresses in the clipboard and directly in form fields, with potential for funds to be diverted. The full scope and timeline remain under investigation.

Key Takeaways

1. Attackers modified a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses.
2. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities.
3. Anyone who visited a site carrying the affected script on July 27 and copied a Bitcoin, Ethereum, or Tron address may have pasted a different address inserted by the malicious code instead.

Statement Breakdown

• Claimed Facts: 60% of statements the article presents as facts
• Opinions: 30% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents factual information about a security incident with clear details on the attack vector and company response. It cites security researchers and the affected company, providing a balanced view. However, some details regarding the timeline and the full scope of the attack remain unresolved.

Bias assessment: Technical Security Reporting. The article focuses on reporting a technical security incident with a neutral, informative tone. It prioritizes factual reporting of events, technical details, and official statements from the affected company and researchers.

Note: This report details a security incident. Verify details with Adform and consult security experts for full impact assessment.

Credibility flag: Investigate Further

Claimed Facts (6)

• This is a direct statement of fact regarding the company's actions and timeline.
• This provides a specific technical detail about the compromised file and its source.
• This is a technical description of the malicious code's structure.
• This describes a specific function of the malicious script.
• This details a network communication attempt made by the malicious script.
• This provides factual data from Adform's official report.

Opinions (6)

• This is an assessment of the current state of information regarding the incident's timeline.
• This is an interpretation of the technical situation, classifying it as a supply-chain compromise.
• This is a statement about a potential consequence, framed as a possibility rather than a confirmed event.
• This is a report of an observation by a third party, which is presented as a finding but reflects a specific point in time.
• This is an analytical statement about the script's functionality and its implications.
• This is a statement of Adform's findings, which is presented as their current assessment.

Claims (5)

• This statement, attributed to Kevin Beaumont, describes a persistent and potentially alarming behavior of the malware, which, while plausible, is presented with a degree of alarm and without immediate corroboration of its exact persistence mechanism.
• This is a broad claim about the script's capabilities that, while technically possible, is presented without specific detail on how these events are intercepted and manipulated, making it a claim that requires further technical substantiation.
• This statement points to a potential data exfiltration capability but explicitly states that its actual execution is unconfirmed, making it a speculative claim.
• While likely true, this is a statement of absence of information, which can sometimes be used to imply a lack of transparency or control, though in this context it's a factual observation.
• This statement from Adform acknowledges a potential capability for data transmission, but the use of "may have been possible" indicates a lack of definitive proof, making it a claim of potential rather than confirmed action.

Key Sources

• The Hacker News — Media
• Adform — Advertising Technology Company
• Kevin Beaumont — Independent Security Researcher
• Max Maass — Security Researcher