On February 21, 2025, when copyright workers went to approve and indicator a plan transfer, the UI showed what seemed to be a legit transaction with the intended desired destination. Only after the transfer of funds on the concealed addresses established via the malicious code did copyright wor