AI developer ORO discloses that North Korean hackers stole its cryptocurrency worth $630,000

ChainCatcher news: According to Protos, AI shopping agent developer ORO disclosed that it lost approximately $630,000 due to a suspected North Korean hacker attack. The attackers gained access to the ORO team by using a compromised Telegram account to send employees a fake Microsoft Teams link, tricking them into installing a malicious extension. After nearly a month of data theft, they stole 147,000 Alpha tokens on July 13. ORO is highly confident that the attack originated from North Korean hacking group Sapphire Sleet.

ORO also admitted to its own security oversight — due to inadequate hardware wallet support in the Bittensor protocol, the company “temporarily” set the owner’s key as a software wallet, violating its internal hardware wallet priority principle, which resulted in the key being stolen from a compromised computer. ORO stated that it is working with exchanges, law enforcement, and Bittensor ecosystem partners to recover the stolen assets, and emphasized that its subnet is operating normally, with other wallets, user data, and validator signing keys unaffected.