According to Protos, AI shopping agent developer ORO released a post-incident report saying that due to an employee accidentally clicking a malicious software update disguised as Microsoft Teams while communicating with meeting contacts on Telegram whose accounts had already been compromised, computers were infected with a malicious extension. The extension lay dormant for nearly a month before stealing 147,000 Alpha tokens from ORO’s wallet on July 13, worth about $630k. ORO’s macOS intrusion analysis suggests the attack originated from the North Korean hacker group Sapphire Sleet. ORO also admitted that because the Bittensor ecosystem lacks sufficient support for hardware wallets, it temporarily set the owners’ keys to a software wallet, leading to the assets being stolen.