Woofun AI reports that AI shopping agent developer ORO confirmed a security breach resulting in the theft of 147,000 Alpha tokens, valued at approximately $630,000. The incident occurred on July 13 after attackers used a compromised Telegram account to send spoofed Microsoft Teams links, tricking employees into installing malicious extensions. ORO attributes the attack to the North Korean group Sapphire Sleet and acknowledges that storing owner keys in software wallets, rather than hardware wallets due to Bittensor protocol limitations, facilitated the theft. The company stated that its subnet remains operational, with user data and validator keys unaffected, and is collaborating with law enforcement and ecosystem partners to recover the assets.