Safe Developer Devices Hacked, Leading to Malicious Code Injection

SlowMist has disclosed that devices belonging to Safe developers were compromised, resulting in the injection of malicious code into the front-end application’s JavaScript files. This attack intercepted and altered transaction parameters before being detected. Subsequent analysis confirmed the presence of malicious code within these files, linked to address 0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516 associated with an execution contract responsible for siphoning off $1.5 billion in assets from ByBit.