On February 21, 2025, when copyright staff members went to approve and indication a routine transfer, the UI confirmed what seemed to be a reputable transaction Together with the supposed desired destination. Only once the transfer of funds to the hidden addresses set by the malicious code did