SlowMist confirms that the Safe developer device has been hacked, and the front-end has been injected with malicious code

According to SlowMist's analysis, the Safe developer device was hacked, resulting in the front-end being implanted with malicious code that can intercept and modify transaction parameters, thereby hijacking user assets. After verification, it has been confirmed that the JS files in the Safe frontend do contain malicious code, and hackers used this vulnerability to steal Bybit's $1.5 billion assets. SlowMist pointed out that the malicious contract address used by the attacker is 0xbdd077f651e7f7b3ce16fe5f2b025be2969516.