What happened
Minting multisig had a 1-of-3 threshold; one compromised key gave full control.
Transaction-level mechanics
Public post-incident disclosures do not include full transaction calldata or execution traces for this incident.
TODO: Add exact Safe transaction hash, decoded actions, and the on-chain state changes once verified primary sources are available. For now, the attack vector summary above is derived from public reporting.
What independent decoding / hash verification / config scanning would have caught
Clean catch. This is exactly what Safe Inspector flags: 'threshold of 1 removes multisig protection' is a stock High finding. A single scan at any point pre-hack would have surfaced it.
Verdict
Could have helped