AI developer ORO disclosed that North Korean hackers stole $630,000 worth of cryptocurrency

According to Protos, AI shopping agent developer ORO disclosed that it suffered losses of approximately $630,000 due to a suspected North Korean hacker attack. The attackers sent spoofed Microsoft Teams links to ORO employees through a compromised Telegram account, inducing them to install malicious extensions, and after nearly a month of data theft, stole 147,000 Alpha tokens on July 13. ORO is highly confident that the attack originated from the North Korean hacker group Sapphire Sleet.

ORO also admitted to security negligence—due to insufficient hardware wallet support in the Bittensor protocol, the company "temporarily" set the owner keys to software wallets, violating its internal principle of prioritizing hardware wallets, which led to the keys being stolen from the compromised computer. ORO stated that it is working with exchanges, law enforcement, and Bittensor ecosystem partners to recover the stolen assets and emphasized that its subnet is operating normally, and other wallets, user data, and validator signing keys were not affected.