43-minute window period, the attacker has thoroughly studied the Safe interface, and now 2784 ETH is still lying in the cold wallet.

Superfortune updated on X stating that the attack was carried out by non-internal personnel, with no involvement from the team, and that rumors about token sales are false.
Upon investigation: the attack was not due to address poisoning, but because the signer's private key was leaked, and the attacker held the private key alone, sending forged address transactions 43 minutes later.
The forged address shares the first and last four characters with the real address, used to disguise on the Safe interface.
Stolen funds are still traceable, currently held in three Ethereum cold wallets with approximately 2,784 ETH, and about 170k USDT cross-chain transferred out.
The attacker heavily mimicked addresses, using Unicode fake symbols to confuse tracking, indicating industrial-scale operations rather than opportunistic attacks.