AI firm ORO says North Korean hacker stole $600K worth of crypto

AI shopping agent developer ORO has revealed that it lost $630,000 worth of crypto when a suspected North Korean state hacker, posing as a conference contact, tricked a staff member into installing a malicious Microsoft Teams extension.

According to a post-mortem released by ORO, one of its team members met a contact at an industry conference in February 2025 and formed a “legitimate relationship” that involved communicating on Telegram.

Almost a year later in May 2026, the Telegram account belonging to this genuine contact reached out to schedule a catch-up call.

However, when the ORO staff member joined the call via a link that mimicked Microsoft Teams, there was no working audio, and so the pair rescheduled for another day.

Almost immediately, the team member’s computer prompted them to update Microsoft Teams, and, thinking nothing of it, they okayed the procedure.

However, the seemingly innocent update allowed a malicious extension to be installed onto their computer. This extension tracked their keyboard inputs, clipboard history, took screenshots of the computer’s page and browser history, and could swap out crypto addresses.

The attacker spent almost a month quietly collecting data before, on July 13, they drained ORO’s crypto wallets of 147,000 Alpha tokens.

ORO believes attack came from North Korea

ORO maintains that the contact at the conference was “legitimate,” and that their Telegram account had become compromised.

As for who the attacker is, ORO claims with “high confidence,” based on its macOS intrusion, that it’s a North Korean hacker from the state-backed group Sapphire Sleet.

It said, “The IP address that our compromised machine was beaconing to, the matching payload and some overlapping infrastructure outlined in the above post from Microsoft makes us confident that the attack came from this group.”

Indeed, Microsoft’s Threat Intelligence department highlights how Sapphire Sleet uses Teams-themed cover, social engineering, and focuses on macOS.

“By impersonating a legitimate software update, threat actors tricked users into manually running malicious files, allowing them to steal passwords, cryptocurrency assets, and personal data while avoiding built‑in macOS security checks,” it said.

ORO claims it’s partly responsible for $600K hack

Despite the hacker’s actions, ORO also partly admitted responsibility for causing the hack.

It claims that a lack of widespread support for hardware wallets in decentralised protocol Bittensor meant that the firm, going against its preference for hardware wallets, “temporarily” established the owner key as a software wallet.

It said, “This is what allowed it to be exfiltrated from a compromised machine. That was inexcusable, and it was our mistake. We are sorry for the impact this has had on our community and our supporters.”

ORO claims it’s actively pursuing the recovery of the stolen assets with the help of cryptocurrency exchanges and law enforcement, as well as Bittsensor agent firm Opentensor, Bittsensor wallet firm Curciible Labs, and Bittsensor AI infrastructure firm Connito AI.

The company also stressed that its subnet is “fully operational,” no other wallets, user, or subnet data was affected, and that validator signing keys on hardware wallets “were never exposed.”

A number of North Korea-related crypto attacks have been uncovered in recent months.

In April, a North Korean mole known as “Moo” was exposed by crypto sleuth ZachXBT and subsequently fired from Solana-based DEX Stabble.

This month, the crypto wallet firm MetaMask was revealed to have employed a North Korean mole as a developer for at least a month.

According to a DeFi security analyst, the developer’s links to Lazarus Group, another North Korea-based hacking group, were publicly available for almost a year.