Malicious Adform CDN Script Caught Swapping Crypto Wallet Addresses on Client Websites

A supply chain attack detected this week has turned a widely used advertising script into a tool for cryptocurrency theft. Adform, a global digital advertising platform, confirmed that a JavaScript file hosted on its content delivery network (CDN) was altered to contain malicious code. This code, when loaded by any website that included the script for ad-tracking purposes, would scan the page for cryptocurrency wallet addresses—such as Bitcoin or Ethereum—and replace them with addresses controlled by the attackers.

The poisoned script was delivered through a legitimate Adform integration that many e-commerce, media, and content sites rely on. Because the script originated from a trusted domain and was loaded dynamically, standard browser security features and many client-side security tools did not flag it. The injection was designed to activate only when a user visited a page containing a wallet address, making it stealthy and difficult to detect without post-compromise analysis.

Website operators often have limited visibility into third-party script behavior after deployment. In this case, the compromised script used standard DOM manipulation to locate and rewrite visible wallet addresses in real time, all within the user’s browser. The actual theft occurred when a visitor attempted to transfer funds to the displayed address, unwittingly sending crypto to the attacker. Because the alteration happened client-side, server logs would show no sign of tampering, leaving affected sites unaware of the code change unless they performed routine integrity checks on external resources.

To mitigate such attacks, site owners should implement Subresource Integrity (SRI) hashes for all externally loaded scripts whenever feasible. Content Security Policies (CSP) can restrict which domains are allowed to execute JavaScript, though this may not prevent abuse from trusted origins that get compromised. Regular audits of all third-party assets and monitoring for unusual script behavior are also essential. For site owners, a managed hosting platform like AEU Hosting can add a layer of defense by continuously monitoring for script changes and applying security hardening that limits the impact of third-party compromises.

The incident underscores the risks of client-side supply chain attacks, where even a single line of malicious code embedded in a trusted library can undermine transaction security across hundreds of websites. Users are advised to double-check wallet addresses directly from the source system rather than relying solely on what a webpage displays, and site operators should reassess their dependency on external ad and analytics scripts.