ORO, a developer of AI shopping agents, lost $630,000 in crypto after a suspected North Korean state-backed hacker spent nearly a month quietly sitting inside one of its employees' computers before draining the wallets on July 13. The attacker walked in through a familiar face.

It started at an industry conference in February 2025, where an ORO team member met someone and built what the company describes as a "legitimate relationship," with regular contact over Telegram. That was real. What happened next wasn't. In May 2026, the same Telegram account reached out to schedule a catch-up call. The ORO employee joined via a link that looked like Microsoft Teams. Audio didn't work. They rescheduled. Moments later, the computer prompted a Teams update. The employee clicked through without a second thought.

That prompt was the attack. The "update" installed a malicious extension that logged keystrokes, captured clipboard contents, took screenshots, tracked browser history, and could silently swap out crypto wallet addresses. The hacker then waited almost a month, collecting data, before moving on July 13 and emptying ORO's wallets of 147,000 Alpha tokens.

The contact's Telegram had been compromised. ORO confirmed this in its post-mortem, noting that the person from the conference was genuine, their account was not. On its public post the company wrote: "The worst part was, it was through someone we knew who's telegram was compromised."

Sapphire Sleet and a self-inflicted vulnerability

ORO says it has "high confidence" the attack came from Sapphire Sleet, a North Korean state-backed group. The basis: the IP address the compromised machine was beaconing to, plus payload and infrastructure details that overlap with findings published by Microsoft's Threat Intelligence team. Microsoft has previously documented how Sapphire Sleet uses Teams-themed lures, social engineering, and specifically targets macOS, tricking users into manually running malicious files to bypass built-in security checks.

But ORO also pointed the finger at itself. The company prefers hardware wallets, but limited hardware wallet support within the decentralised Bittensor protocol led it to "temporarily" store the owner key in a software wallet instead. That decision is what made the funds extractable. Without it, the attacker's month of data collection would have led nowhere near $630,000.

This article is for informational purposes only and does not constitute financial advice or an investment recommendation.