Adform JavaScript Supply Chain Attack: Crypto Wallet Addresses Replaced Through Compromised Script

### Executive Summary On July 27, 2026 attackers modified Adform’s shared JavaScript resource (trackpoint-async.js) in a supply-chain attack that injected in-browser malware to monitor and replace Bitcoin, Ethereum, and Tron wallet addresses (including clipboard and form inputs) with attacker-controlled addresses; Adform detected and removed the malicious script the same day, notified customers, and reported the incident while investigations into the full scope and potential financial impact continue.