Attackers Stole One API Key and Resold It Until the Bill Hit $1 Million

A stolen API key, resold by the million, and a bill approaching seven figures

Attackers picked up an exposed API key, wired it into a gray-market resale platform within minutes, and started selling access to somebody else's AI account. The organisation that owned the key found out the way most victims do, from the invoice. By then the charges were approaching one million dollars.

Palo Alto Networks' threat research unit, Unit 42, published that case on 6 August 2026 in a report on what it calls token jacking. The figure is arresting. The mechanism is the part worth your attention, because nearly every control that should have caught the spending had been switched off by the attacker before it began.

How the theft actually works

An API key is a long string that lets a program call a service on your behalf without a human logging in. AI providers bill by the token, a token being a small chunk of text going into or coming out of the model, and frontier models cost considerably more per token than older ones. Because nobody can predict how much a long conversation or an autonomous agent will consume, most providers do not cap usage at all. They tally it and invoice at the end of the cycle. That combination, programmatic access with no ceiling and payment long after the fact, is what makes a stolen key worth real money.

The demand side is the part most security teams have never seen. Unit 42 traced it to what the trade calls transfer stations: gray-market shops, advertised largely on Chinese-language marketplaces such as Taobao, that resell access to Claude, GPT and Gemini at a fraction of list price. Many of them run on the same two open-source proxy projects, new-api and one-api, which rotate the stolen credentials, obfuscate the traffic, route each request to whichever model the buyer paid for, and handle the seller's own billing. The economics only work on stolen inventory. Anthropic sells a million Claude Opus input tokens for roughly fifteen dollars, and researcher Harshal Singh documented Taobao sellers offering the same thing for one or two. The keys themselves arrive from infostealer malware (software that quietly harvests saved credentials off a developer's machine), from phishing, from unsecured file shares and public code repositories, from dark-web sales of entire developer accounts, and increasingly from poisoned npm packages such as the self-propagating Shai-Hulud worm, which collects credentials from every environment it touches.

• Where attackers hold a privileged developer account rather than a single key, they mint fresh API keys, provision extra models, remove billing limits, and switch off usage alerts and logging, so the account looks quiet while it is being drained.
• A single transfer station can generate tens of millions of API calls a day, which is how usage fees reach hundreds of thousands of dollars inside one billing cycle.
• The buyers get a worse deal than they think. Unit 42 found transfer stations routing prompts to cheaper models than advertised, and logging customer sessions, which turns the developers using them into the next set of victims.

Why it matters

Start with the recovery position, because it is bleak. Organisations hit by token jacking have almost no route to claw the money back. The compute was genuinely consumed, every call was authenticated with a valid key, and the provider is owed. Unit 42 states plainly that the cost can derail a budget or push a smaller business into insolvency, and Cybernews has documented developers going bankrupt over exposed cloud API keys well before AI made the burn rate this steep. For your own organisation, the exposure is probably not where your threat model currently puts it. Ask how many AI API keys exist across your engineering teams right now, who is allowed to raise a spending limit, and how long it would take anyone to notice consumption that looks like a busy product launch. For most companies the honest answer to that last question is one invoice cycle. The systemic shift underneath is that AI compute has become a liquid stolen commodity with a functioning resale market, priced and advertised and delivered like any other product. Cloud cryptomining did something similar a decade ago, but a mined coin is worth what it is worth. Frontier-model access is scarce, regionally restricted, and wanted by buyers who include groups seeking cheap access to models they cannot legally reach, which puts a premium on your key that a stolen server never carried.

What to do about it

1. Set hard spending limits on every AI account, and alert on deviation from your normal baseline rather than only on a ceiling. The entire attack depends on consumption nobody sees until the invoice, so a threshold tied to your usual daily spend catches it in hours instead of weeks.
2. Retire long-lived API keys in favour of short-lived tokens issued on demand. A credential that expires in an hour is close to worthless to a transfer station, because the business model needs stable inventory it can resell for months.
3. Treat the power to remove a billing limit or disable usage alerts as a privileged action. Attackers turn those controls off first, so restrict who can change them and log the change itself as a security event rather than an accounting one.

Bottom line

No data was stolen in the case Unit 42 describes, and no ransomware ran. Somebody simply used a company's AI account as though it were their own and sold the output on. Bring the shape of it to your next security meeting: an API key sitting in a repository has stopped being a credential risk and become an uncapped line of credit in your company's name, with a working market ready to draw on it within minutes of finding it. Unit 42's report lists the indicators, including the transfer-station domains and the user agent seen on the malicious calls.