Hackers Steal Computing Power at Firm --- Demand for models turns AI credentials into a lucrative target for criminals

“Hackers started probing cloud-computing company Railway on a Sunday night in mid-October, signing up for thousands of accounts. Within days, they made off with assets worth more than $1.1 million.

 

Most of the loot didn't come from cryptocurrency. This hack wasn't about extortion or ransomware, either. It was a smash-and-grab theft of the artificial-intelligence era's most valuable commodity: computing power.

 

Railway is one of about a dozen AI developer platforms hit with a swarm of cyberattacks over the past month. Some have involved data theft, but in many cases, the hackers targeted online credentials called API keys that are then being used to illicitly access American AI models.

 

In the Railway hack, the criminals did steal about $371,000 in cryptocurrency.

 

But they also stole keys belonging to the company's customers and ran up at least $750,000 in AI charges on services that included Amazon.com's Bedrock, OpenAI, Anthropic and Google's Gemini, Railway said.

 

Following another hack at AI infrastructure company Zeabur, stolen API keys were used for $100,000 in charges, the company said.

 

Hackers also steal API keys directly from large corporations with enterprise accounts, making as much as $100,000 in fraudulent charges in a single day.

 

Total losses from what is called LLM jacking -- referring to large language models -- can mount to $1 million for an organization, Google said.

 

Some of these attacks appear aimed at supplying the stolen compute to illicit websites known as transfer stations, according to researchers at Google's cloud-security division, Wiz.

 

The sites sell access to American AI models to users in restricted countries, including China, Russia and Iran. Recently Anthropic said that these transfer stations are often used to help clone U.S. AI models using a technique called distillation.

 

"These sites are getting tens of millions of visitors per month," said Matthew Lenhard, founder of the token-fraud prevention service Vectoral. "People are getting rich off of this."

 

Transfer stations have become an established part of China's economy, providing cheap access to U.S. frontier models, said Kumi Mita, an analyst with the blockchain investigations company Chainalysis. Mita has counted more than 700 such services online.

 

The top five of these stations have collectively made nearly $6 million in cryptocurrency, Chainalysis said.

 

To gain access to American AI models, the transfer stations turn to swindlers who steal account credentials, create fake companies to claim free token credits or use stolen credit cards, Vectoral's Lenhard said.

 

In criminal forums, access to AI models is increasingly for sale, according to the intelligence firm Flashpoint.

 

In addition to selling the credentials, scammers can use them to generate phishing emails, create fake reviews or write software, the company said.

 

The victims, meanwhile, foot the bill.

 

In the case of the Railway hack, computing infrastructure used by the hackers was also used by a transfer station called LLM-Routing, which claims to sell access to Anthropic and OpenAI and Google models starting at "around half the official price," according to the company's website.

 

Representatives from LLM-Routing couldn't be reached for comment.

 

Staffers at Railway, a six-year-old company that is used by about five million software developers, were at a company retreat when they started getting alerts about unusual activity on their network.

 

Using a variant of an AI attack tool called Artex, the hackers had broken out of a software container designed to isolate Railway customers from the rest of the company's infrastructure.

 

From there, they downloaded a snapshot of the company's source code.

 

It was the digital equivalent of a road map to the company's computer systems. With this information, they found a way to gain access to as many as 100,000 customer accounts containing API keys. These keys are used by customers on Railway's platform to run their AI applications.

 

"They had just a crazy, significant amount of compute," said Angelo Saraceno, a Railway engineer.

 

It all felt too fast and too wide-ranging to be human, trying to find holes everywhere in Railway's defenses. They would gain access to a system, find a way to get total control over it and then look for new ways to move around the network.

 

And unlike humans, the attacker here never took a break, Saraceno said. "It felt like a nonstop onslaught."

 

Customers were livid, complaining online that the company had taken too long to warn them of the breach.

 

One customer wrote on X: "so many projects and soooo many keys. This is bad, quite bad."

 

The founder of the AI software development site OpenCode predicted that these attacks are "not going to stop." OpenCode's customers had been hammered by a similar LLM jacking attack, which started two days before Railway's.

 

The "only reason we're surviving is because we have agents going 24/7," OpenCode co-founder Dax Raad wrote on X, adding that his team was "barely sleeping."

 

Saraceno wrote him back: "we haven't been sleeping much on our side but it does seem like (personal opinion) we are in the 24/7 drone swarm era of cyber."

 

The cybersecurity firm R10N Security analyzed logs of AI sessions that were conducted using credentials stolen from Railway customers. They were used for a variety of tasks, including to build a 3-D videogame and conduct research for real-estate development, but they also appeared to be used for preparation work for a distillation attempt, said Ryan McGeehan, R10N's owner.

 

The wave of attacks on cloud AI development platforms began in early October and shows no signs of abating, according to cybersecurity investigators.

 

They are part of a fast increase in AI-powered cybersecurity hacks and incidents that has pushed responders to their limits.

 

"Is this a bad two weeks," asked Ben Read, a researcher with Wiz, "or is this going to be the next two years?"

 

In late October, Zach Lloyd, the founder of cloud-computing company Warp, described the attack on his company as an apparent "agent swarm."

 

After the hack at Zeabur last month, the three-year-old cloud-service provider decided to shut down permanently.

 

"The API key is money right now," Zeabur founder Yuanlin Lin said. "Attacking an infrastructure company is just like hacking a bank."” [1]

 

1. Hackers Steal Computing Power at Firm --- Demand for models turns AI credentials into a lucrative target for criminals. McMillan, Robert.  Wall Street Journal, Eastern edition; New York, N.Y.. 11 Nov 2026: B4.