Comment by alwa

TFA seems to suggest that the thieves modified the signers’ applications to display a routine transaction but actually sign the heist transaction.