Security firms traced the $7.8 million loss to a helper contract authorized by the wallet owner, not to Safe itself.