Similar to other stolen goods, it's not hard to resell tokens on the black market: https://vectoral.com/blog/token-relay-market

They might have spent next to 0 time actually 'hacking' - they may have just told Opencode to hack Opencode website and let it run for hours or days till it succeeded.

API keys have been routinely stolen in mass automated attacks for malicious usage long before LLMs even existed

The tokens of frontier are valuable...