A SafeTx covers to, value, data, operation (0 call, 1 delegatecall), gas parameters, refundReceiver and nonce, under a domain of chainId and the Safe address. Owners sign that hash with eth_signTypedData, with eth_sign (reported with v increased by 4) or approve it on-chain; the Safe checks signatures sorted by owner address against the threshold.
Because hardware wallets often can only show the hash, owners should compute it independently and compare it with the device screen. In the February 2025 Bybit theft (about 1.5 billion US dollars) attackers compromised Safe's hosted web interface, which showed signers a routine transfer while their devices signed a delegatecall that replaced the wallet's implementation. The Safe transaction hash tool recomputes the domain, message and transaction hashes offline.