Security firms traced the $7.8 million loss to a helper contract the wallet owner had authorized, not to Safe itself.