[drewmol]

Do you think it’s at all likely they were able to exfiltrate the keys or escalate privileges by pushing the malicious update? It’s not an iOS or android update from my understanding, just an update to the backend/content server.

[vgatherps]

The content server probably wouldn't be useful for getting the keys, unless they have some insane wallet manager.

My best guess is simple key exfiltration?