SlowMist releases Bybit attacker operation details

Odaily Planet Daily News: SlowMist releases Bybit attacker operation details: 1) A malicious implementation contract was deployed at UTC 2025-02-19 7:15:23: https://((etherscan.io))/address/0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516 2) UTC 2025-02-21 14:13:35, the attacker used three owners to sign a transaction and replaced Safe's implementation contract with a malicious contract: https://((etherscan.io))/tx/0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882 3) The attacker then used the backdoor functions "sweetETH" and "sweetERC20" in the malicious contract to steal the hot wallet.