A poisoned JavaScript file served by ad tech firm Adform rewrote crypto wallet addresses on customer sites.