AI shopping agent developer ORO has revealed that it lost $630,000 worth of crypto when a suspected North Korean state hacker, posing as a conference contact, tricked a staff member into installing a malicious Microsoft Teams extension.

According to a post-mortem released by ORO, one of its team members met a contact at an industry conference in February 2025 and formed a “legitimate relationship” that involved communicating on Telegram.

Almost a year later in May 2026, the Telegram account belonging to this genuine contact reached out to schedule a catch-up call. 

However, when the ORO staff member joined the call via a link that mimicked Microsoft Teams, there was no working audio, and so the pair rescheduled for another day. 

Almost immediately, the team member’s computer prompted them to update Microsoft Teams, and, thinking nothing of it, they okayed the procedure. 

Read more: MetaMask hired suspected North Korean dev flagged months earlier

However, the seemingly innocent update allowed a malicious extension to be installed onto their computer. This extension tracked their keyboard inputs, clipboard history, took screenshots of the computer’s page and browser history, and could swap out crypto addresses.  

The attacker spent almost a month quietly collecting data before, on July 13, they drained ORO’s crypto wallets of 147,000 Alpha tokens.  

ORO believes attack came from North Korea

ORO maintains that the contact at the conference was “legitimate,” and that their Telegram account had become compromised. 

As for who the attacker is, ORO claims with “high confidence,” based on its macOS intrusion, that it’s a North Korean hacker from the state-backed group Sapphire Sleet.  

It said, “The IP address that our compromised machine was beaconing to, the matching payload and some overlapping infrastructure outlined in the above post from Microsoft makes us confident that the attack came from this group.”

Indeed, Microsoft’s Threat Intelligence department highlights how Sapphire Sleet uses Teams-themed cover, social engineering, and focuses on macOS. 

“By impersonating a legitimate software update, threat actors tricked users into manually running malicious files, allowing them to steal passwords, cryptocurrency assets, and personal data while avoiding built‑in macOS security checks,” it said. 

ORO claims it’s partly responsible for $600K hack

Despite the hacker’s actions, ORO also partly admitted responsibility for causing the hack. 

It claims that a lack of widespread support for hardware wallets in decentralised protocol Bittensor meant that the firm, going against its preference for hardware wallets, “temporarily” established the owner key as a software wallet. 

It said, “This is what allowed it to be exfiltrated from a compromised machine. That was inexcusable, and it was our mistake. We are sorry for the impact this has had on our community and our supporters.”

ORO claims it’s actively pursuing the recovery of the stolen assets with the help of cryptocurrency exchanges and law enforcement, as well as Bittsensor agent firm Opentensor, Bittsensor wallet firm Curciible Labs, and Bittsensor AI infrastructure firm Connito AI.

The company also stressed that its subnet is “fully operational,” no other wallets, user, or subnet data was affected, and that validator signing keys on hardware wallets “were never exposed.”

Galaxy Digital (GLXY) said it set up a $5 million fund for Bitcoin developers working to protect the network from the potential future threat posed by quantum computing.

The crypto financial services company said it will begin accepting applications for the Galaxy Bitcoin Quantum Readiness Initiative immediately, with grants focusing on developing quantum-resistant signature schemes, wallet migration tools and security audits. The company said it hopes other firms will contribute funding and research to accelerate the transition to quantum-resistant cryptography.

Bitcoin secures wallets and transactions with cryptographic techniques that current computers cannot break in a meaningful timeframe. While quantum computing is still too immature to attack the blockchain, advances in the technology have accelerated efforts across government and industry to adopt quantum-resistant standards before the threat becomes a reality.

In the event that quantum computers do become capable of breaking Bitcoin’s cryptography, roughly 6.9 million bitcoin BTC$66,430.63 could become vulnerable to theft, according to CryptoQuant research. At today’s price of about $66,800, that comes to about $461 billion.

Bitcoin has risen 2.2% to $66,681, and XRP has gained 3.6% to $1.152 as both assets test chart resistance while Iran claims it struck Amazon’s data infrastructure in Bahrain.

IRNA, Iran’s state news agency, has reported that the Islamic Revolutionary Guard Corps used several cruise missiles to attack what it described as Amazon’s central data infrastructure in Bahrain on July 21. The IRGC claimed the facility was destroyed, although Amazon and Bahraini authorities had not confirmed the reported damage at the time of writing.

According to the IRGC, the operation came in response to a US attack on the construction site of Iran’s Darkhovin nuclear power plant. The Iranian force has also threatened 18 American technology companies, including Microsoft, Intel, Cisco and Google, over their alleged links to US military and intelligence activity.

Amazon Web Services facilities in Bahrain and the United Arab Emirates have already faced attacks during the conflict. In April, an Amazon cloud facility in Bahrain had sustained damage in an Iranian attack, while service interruptions affected AWS infrastructure elsewhere in the region.

Investors reacted cautiously because the latest IRGC account lacked independent confirmation. Amazon shares had closed Monday 1.12% higher at $249.99, but US stock futures later surrendered part of their earlier gains as reports of the alleged attack circulated.

Military action continued while Pakistan pursued another diplomatic effort. The US Central Command had completed a new series of attacks on Iran, extending the American campaign to a tenth consecutive night.

CENTCOM listed Iranian command centers, maritime assets, missile and drone launch sites, and air-defense systems among the targets. The US military stated that the strikes were intended to reduce Iran’s ability to attack commercial vessels passing through the Strait of Hormuz.

At the same time, the Associated Press reported that Pakistan was trying to restart ceasefire negotiations. Those efforts continued as Iran attacked targets in Bahrain, Kuwait and Jordan and fighting disrupted commercial traffic through the Strait of Hormuz.

Bitcoin recovery runs into Fibonacci resistance

Bitcoin (BTC) rose from a daily low of $65,149 to an intraday high of $66,956 on Binance, according to the supplied TradingView chart. The move placed BTC directly below the 61.8% Fibonacci retracement at $67,257, calculated from the decline between $82,485 and $57,845.

TradingView’s daily setup identifies $67,257 as the immediate technical barrier. A daily close above it would expose the 50% retracement at $70,165, while another advance could bring the 38.2% level at $73,073 into view.

Failure to clear the 61.8% line would leave Bitcoin inside the recovery range formed since its late-June low. The same chart places the closest marked downside level at $63,118, which corresponds with the 78.6% Fibonacci retracement and overlaps with recent consolidation.

Momentum has improved alongside the rebound. Bitcoin’s relative strength index stands at 61.91, above its moving average of 53.05 but still below the overbought threshold of 70, according to TradingView.

The daily MACD also remains positive, with the MACD line at 508.46, the signal line at 406.09 and the histogram at 102.37. TradingView’s readings show bullish momentum, although the small gap between the two lines means BTC still requires follow-through above $67,257 to strengthen the signal.

Bitcoin’s latest candle opened at $65,255 and remained positive when the chart was captured. However, the unfinished daily candle means the attempted break cannot be confirmed until the session closes.

XRP breakout points toward $1.30

XRP (XRP) price has moved above the descending boundary of a symmetrical triangle on its Binance daily chart. TradingView data shows the token advancing from a session low of $1.111 to an intraday high of $1.158 after several weeks of contracting price action.

The pattern developed between falling resistance from the mid-June swing high and ascending support extending from the late-June low. XRP’s move above the upper trendline indicates a breakout attempt, although confirmation still depends on a daily close outside the formation.

Based on the measured height displayed on the supplied chart, the triangle carries a projected move of about $0.2845. Applying that distance to the breakout area places the first marked target near $1.30.

A second resistance line appears at $1.374, which acted as a trading area before XRP’s sharp decline in early June. The chart therefore shows $1.30 as the first target and $1.374 as the next barrier if buyers maintain control.

TradingView’s Aroon indicator supports the bullish attempt, with Aroon Up at 100% and Aroon Down at 42.86%. Chaikin Money Flow has also climbed to 0.08, indicating that buying pressure has returned during the breakout.

A move back below the triangle’s upper boundary near $1.10 would weaken the pattern and place its rising support at risk. Sustained trading above the breakout line would preserve the chart’s path toward $1.30, though the unverified Amazon strike claim and continued US-Iran attacks could increase volatility across both XRP and Bitcoin.

Bitcoin extended its early gains into the Wall Street open, tracking a broader buoyancy in US risk assets despite fresh geopolitical and tariff-related headlines. TradingView data showed BTC/USD pressing toward $67,000 and edging close to its seven-week highs.

What stands out for traders is that neither the latest escalation in the US–Iran situation nor renewed talk of international trade tariffs has meaningfully derailed momentum in crypto markets. Instead, price action suggests participants are leaning toward the view that any disruptions may be temporary—at least for now.

Key takeaways

• BTC moved toward $67,000 and threatened fresh multi-week highs as stocks held up into the US session.
• Escalating tensions involving Iran and the Strait of Hormuz coincided with strength in risk assets rather than a selloff.
• Reported US tariff plans could have been a headwind for speculative markets, but traders appeared to expect a resolution.
• Analysts warn Bitcoin needs to reclaim its 21-week simple moving average to credibly challenge the broader bear-market structure.

Geopolitical escalation and tariff talk fail to cool risk appetite

According to TradingView, BTC/USD approached $67,000 during the session, with momentum that began earlier appearing to persist. The cryptocurrency’s relative resilience came alongside firm trading in US equity futures.

At the same time, the day’s headlines pointed to conditions that often support “risk-off” behavior. The US–Iran conflict saw further escalation after Iran struck targets at Amazon facilities in Bahrain in response to US strikes, and reporting indicated the Strait of Hormuz oil route remained closed.

In commodity markets, the geopolitical pressure showed up in crude prices: WTI oil rose to its highest level in over a month, nearing $85 per barrel, as TradingView’s WTI CFDs chart reflected.

On the policy front, multiple outlets reported that President Donald Trump is planning to introduce new 10% international trade tariffs. The proposal is described as following 50% measures imposed on Canada earlier in the week. Historically, tariff uncertainty can weigh on broader risk sentiment, yet crypto traders did not appear to react with sustained caution.

Instead, commentary from market participants suggested expectations that the situation would ultimately resolve in favor of markets. YouTube host Crypto Rover, for example, summarized the prevailing stance in an X post, writing that “Markets are pricing in peace.”

Stocks in focus as macro risks get tested

While crypto held up, some investors remained confident about near-term equity direction. Caleb Franzen, who runs macro analysis resource Cubic Analytics, posted on X that he had “zero fear” or worry regarding S&P 500 futures, describing the setup as supportive.

Still, the optimism was not universal. Cautionary notes surfaced from senior banking leadership, including JPMorgan CEO Jamie Dimon, who warned that markets were not pricing risks aggressively enough relative to what could come next. The juxtaposition highlights the tension investors face: risk assets can keep rising even when underlying risks are real, as long as participants believe outcomes will be less severe than feared.

Technical pressure point: the 21-week trendline

For Bitcoin-specific direction, attention shifted from short-term resistance levels to a longer moving-average benchmark. Material Indicators cofounder Keith Alan offered a more guarded view of the near-term outlook, arguing that the bear market may still be intact until BTC confirms a stronger trend.

Alan pointed to a “golden cross” involving the 21-day and 50-day simple moving averages on Monday, but emphasized that such signals on lower timeframes don’t necessarily negate a broader downturn. In his X analysis, he warned that bear markets do not always look like bear markets—especially when price action is volatile but not trend-confirmed.

The key condition, according to Alan, is whether Bitcoin can reclaim its 21-week simple moving average. He wrote that the macro trend would be challenged only if BTC pushes above that level, noting that until then, “the Bear Market remains intact.”

At the time of writing, the 21-week SMA was cited at $69,720, a figure that also aligns with Bitcoin’s 2021 all-time high. The larger implication is that reclaiming this long-term trendline would signal more than just a bounce—it would suggest a shift in how the market is pricing longer-duration risk.

Alan also acknowledged that there was “no real resistance” until $67,250, which helps explain why traders were willing to press higher even amid macro uncertainty. However, the absence of immediate resistance near $67,000 does not guarantee follow-through if the move fails at the longer-term moving-average level.

What to watch next for BTC

With BTC approaching the high-$60,000 zone, traders are now likely to monitor whether price can build momentum toward the $69,720 21-week SMA area. If Bitcoin cannot reclaim that threshold, analysts like Keith Alan suggest the market may still be operating under a bear-market structure—even if rallies continue to occur in the shorter term.

But the larger pull is simpler: AI is where the speculative money and investors’ attention are now going. The capital that once chased crypto is now chasing compute, chips and model builders, and every leap in what these systems can do widens that appeal.

Each result like Fable’s finding of the Jacobian conjecture strengthens the case for pouring capital into AI, and poses a difficult conundrum for crypto investors: Why hold a token that trades as a sidecar to the AI cycle when someone can own the vehicle itself?

AI’s capability curve is steep, and the steeper it gets, the more of the market’s risk appetite it draws away from everything else, crypto included.

What the problem actually was

Think of a machine that takes two numbers and gives back two new numbers, using only adding and multiplying. The question, first asked in 1939, was whether the machine can always be run backward: given only its answer, can the original two numbers be recovered every time?

Mathematicians had a quick way to check whether a machine looked reversible. The Jacobian conjecture said that if a machine passed that check, it should always be reversible.

For 87 years, nobody could prove it was true, and nobody could find a machine that broke the rule.