Attackers compromised a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool to rewrite cryptocurrency wallet addresses. The malicious code was active on July 27, 2026, and targeted visitors who copied Bitcoin, Ethereum, or other crypto addresses from affected websites. Adform detected and removed the malicious code, notifying clients and authorities. This supply-chain attack demonstrates a sophisticated method for direct financial theft via compromised ad infrastructure.