Bybit hack did not occur, but funds were not returned

Cryptocurrency exchange Bybit has denied reports of a hack on its platform. Company representatives stated that a third-party firm, Safe, was responsible for asset protection, and that the breach occurred due to a vulnerability in its system.

How did this happen?
Two days before the attack, hackers made changes to Safe's JavaScript code, which allowed them to swap addresses when signing transactions from cold wallets. As a result, funds were redirected to accounts controlled by the attackers.

Safe has already fixed the vulnerability, however, the stolen $1.4 billion has not been returned.