On February 21, 2025, when copyright staff went to approve and sign a plan transfer, the UI showed what appeared to be a reputable transaction with the supposed place. Only after the transfer of resources on the hidden addresses established through the malicious code did copyright staff members