Once they had access to Safe Wallet ??s process, they manipulated the consumer interface (UI) that consumers like copyright personnel would see. They changed a benign JavaScript code with code intended to alter the intended destination with the ETH from the wallet to wallets managed by North Korean operatives. This malicious code would only targe