On February 21, 2025, when copyright staff members went to approve and sign a routine transfer, the UI showed what gave the impression to be a authentic transaction While using the supposed destination. Only after the transfer of cash towards the concealed addresses set with the malicious code