On February 21, 2025, when copyright employees went to approve and sign a routine transfer, the UI confirmed what appeared to be a genuine transaction with the intended location. Only after the transfer of funds into the hidden addresses established by the malicious code did copyright employees