On February 21, 2025, when copyright workers went to approve and indicator a plan transfer, the UI showed what appeared to be a legit transaction with the intended spot. Only once the transfer of resources to the hidden addresses established by the malicious code did copyright workers comprehen