OpenCode Got Hacked Badly (My API Keys Got Drained)

The OpenCode hack cost one developer $16 and another $3,000, on the same night, with the same attacker and the same stolen list. The attacker didn't decide which bill you got. The limit on your API key did. On October 17, 2026, OpenCode said a "large scale distillation attack" had reached a legacy system and exposed the OpenAI, Anthropic and Google API keys that developers had saved in the OpenCode Console, its web dashboard for bring-your-own-key (BYOK). The terminal app wasn't part of it. In this video I walk through what actually happened in the OpenCode breach, what OpenCode's own public