On February 21, 2025, when copyright staff members went to approve and signal a schedule transfer, the UI showed what appeared to be a legit transaction with the intended vacation spot. Only after the transfer of funds to the hidden addresses set because of the destructive code did copyright workfor