Security researchers tracked and reproduced the entire attack process through code execution. After unlocking the wallet, the attacker used the GET_SEED_PHRASE function call to obtain the mnemonic data, then filled this sensitive information into the "Error" field (visible in register R1). This technique hides the critical wallet recovery phrase within the error handling mechanism to evade detection, representing a typical Web3 wallet security threat. The vulnerability demonstrates how low-level code operations can extract users' private recovery data, reminding users and developers to strengthen wallet security audits.