The AppsFlyer SDK Hijack: How a Trusted Marketing Script Became the Largest Crypto Address-Swapping Attack in 2026

On March 9, 2026, security researchers at Profero noticed something terrifying: obfuscated JavaScript was being served from websdk.appsflyer.com — the official domain of one of the world's largest marketing analytics SDKs, used by over 15,000 businesses across 100,000 applications. The injected code did one thing brilliantly: it watched for cryptocurrency wallet addresses on any page, silently replaced them with attacker-controlled addresses, and exfiltrated the originals. Bitcoin, Ethereum, Solana, Ripple, TRON — all targeted. This wasn't a smart contract exploit. No flash loans. No oracle manipulation. Just a compromised third-party script running with full page access on thousands of websites, including DeFi frontends, exchanges, and fintech platforms. The Kill Chain: From Domain Registrar to Wallet Drain The attack unfolded in three stages: Stage 1: Domain Registrar Compromise (March 9) AppsFlyer later confirmed a "domain registrar incident" that allowed attackers to inject unautho