Security researchers disclosed this week that attackers compromised a JavaScript tracking file served by the advertising technology firm Adform, turning it into a browser-side tool that silently rewrote cryptocurrency wallet addresses on every website that had embedded it. Adform detected the incident on 27 July, removed the malicious code and notified affected clients — but the file, called trackpoint-async.js, had been quietly monitoring visitors’ clipboards in the meantime, swapping in an attacker-controlled wallet address whenever it spotted a Bitcoin, Ethereum or Tron address being copied and pasted.
No website was hacked directly. Every affected site had simply done what thousands of businesses do every day — embedded a widely-used third-party script for analytics or ad tracking — and had no way of knowing the code being served from that trusted source had changed underneath them.
Why this matters even if you’re nowhere near crypto
It’s tempting to read this as a niche cryptocurrency story and move on. The more useful reading is about the mechanism, not the payload. Adform’s script sits on a huge number of websites that never think about it once installed — it just runs, silently, every time a visitor loads the page. That’s true of most third-party scripts: tag managers, chat widgets, analytics tools, ad pixels, review plugins. Once you embed one, you’re trusting its supplier’s infrastructure stays secure indefinitely, with typically no visibility into whether that trust is still warranted on any given day.
For a small business, this is exactly the kind of risk that falls between the cracks. Nobody owns “checking whether our third-party scripts are still the scripts we think they are” as an ongoing task, because it doesn’t feel like your problem until the day it very much is.
What’s worth actually doing about it
You don’t need to rip out every third-party script your site relies on — that’s neither realistic nor necessary. But a short, periodic review is worth building into how you maintain your site: list every external script your site loads (most site platforms and browser developer tools will show you this), and for each one, ask whether you still need it, whether it’s from a supplier you’d notice a compromise disclosure from, and whether it’s loaded in a way that limits what it can actually do on your page. Subresource Integrity checks, where technically feasible, and content security policies that restrict what scripts can execute are both worth a conversation with whoever built or maintains your site — CoolCoding does this kind of technical implementation work for UK SMEs who want it done properly rather than left to chance.
It’s also worth having a plan for the disclosure moment itself, because that’s the part most businesses have never thought through: if a supplier you embed code from discloses a compromise, do you know who’d tell you, how quickly, and what you’d need to check on your own site in response? KeepSafe monitors for exactly this kind of incident so businesses aren’t relying on stumbling across a security researcher’s blog post to find out their site was affected.
Why detection took as long as it did
One detail worth sitting with is that this wasn’t caught by Adform’s own monitoring — it was flagged by an independent security researcher who happened to be looking at the traffic. That’s a common pattern with supply-chain compromises: the company at the centre of it often isn’t the first to notice, because the malicious behaviour is designed to blend into traffic that already looks routine. For a business relying on a third party’s script, that means your own vigilance can’t simply assume “if something were wrong, they’d have caught it by now.” Sometimes the first anyone hears is a researcher’s write-up days after the fact, which is exactly why having your own independent way of hearing about these incidents matters as much as trusting the supplier to self-report.
The takeaway
The Adform incident is a reminder that your website’s security isn’t just about your own code — it’s about every third party you’ve quietly agreed to trust. A short audit of what’s actually running on your site, and a plan for what you’d do if one of those suppliers got compromised, costs a lot less than finding out the hard way.