Adform, a major advertising technology firm serving roughly 14,000 enterprise businesses and controlling nearly 30% of the demand-side platform (DSP) ad market, suffered a critical supply-chain breach. Security researchers revealed that attackers successfully compromised a core tracking JavaScript file hosted directly on Adform’s servers.
Because thousands of downstream e-commerce, media, and Web3 platforms embed this single tracking script to monitor ad analytics, the single poisoned file immediately infected millions of website visitors in real-time without requiring any user interaction or software downloads.
The Pipeline to Crypto Theft
Supply-chain attacks on widely embedded web scripts represent one of the stealthiest entry points for large-scale wallet draining:
Once the poisoned script loaded inside a user's browser on an infected client site, it executed client-side JavaScript designed to scan web forms and clipboard data for cryptocurrency wallet address formats (such as Bitcoin bc1, Ethereum 0x, or Solana addresses). When a user attempted to copy-paste or auto-fill a recipient address, the script silently modified the string in the DOM, replacing it with an attacker-controlled wallet address.
Because the modification occurs on the web interface level before transaction payload assembly, the transaction sent to the blockchain is 100% valid. Even if a user confirms the transaction on a hardware wallet, if they fail to meticulously verify every character on the device screen, they unknowingly sign a transfer sending their funds directly to the hacker's address.