Recently, it can be said that more and more people have started to try… OpenClaw, although OpenAI、Ollama These services can use OAuth authentication, but they all have usage limits, meaning once you’ve exhausted them, you must wait for the limit to reset before you can continue using them. And to ensure OpenClaw can run properly over extended periods, you might switch to using API Although this approach is very simple and convenient to use, the risks are actually much higher than most people imagine. Key management, permission controls, and usage monitoring all need to be properly configured. Recently, a developer shared how their team Gemini Their API key was stolen, and over NT$2.6 million was charged within just two days. If Google ultimately refuses to waive the charge, the company could face bankruptcy.
Gemini API Key Stolen, Bill Surges to $82,000 in Just 48 Hours
According to foreign media Tom’s Hardware According to reports, a Reddit user named RatonVaquero posted on the forum describing the unprecedented billing crisis faced by their small development team, which they run with two other partners.
The incident occurred because their Google Cloud API key was stolen without their knowledge. Their usual monthly spending was only 180 TWD, but within just 48 hours on February 11th to 12th, the attacker made massive calls to the Gemini 3 Pro Image and Gemini 3 Pro Text API endpoints under their account, causing usage to surge by a staggering 455 times. The final bill amount skyrocketed to an alarming $82,314.44 USD, approximately 2.61 million TWD.
Upon discovering the anomaly, they immediately took all standard emergency measures, including deleting the compromised keys, disabling the Gemini-related API, rotating all credentials, enabling 2FA across the board, tightening IAM (Identity and Access Management) permissions, and submitting a support case to Google support.
But Google’s response left them extremely worried. Customer support invoked the “Shared Responsibility Model” — in plain terms, platform security is Google’s responsibility, but whether your keys are secure is your own problem. In other words, Google hinted that this $82,314 bill would likely still have to be covered by them themselves. RatonVaquero admitted in the post that the entire team is facing bankruptcy.
If Google demanded even one-third of that payment, our company would go bankrupt immediately. We’re barely hanging on right now, hoping that one day our product will succeed.
$82,000 in 48 Hours from stolen Gemini API Key. My monthly Usage Is $180. Facing Bankruptcy
byu/RatonVaquero ingooglecloud
Google Cloud’s billing works differently from other APIs—it’s pay-as-you-go with post-payment settlement, meaning there’s no real hard spending cap. The platform offers “Billing Alerts” that notify you when costs exceed your set threshold, but this is just an email notification, not an automatic shutdown mechanism. So if your API key gets stolen and you wait until you read that email, it could easily have been heavily abused for hours.
RatonVaquero also complained in a post that Google should provide a mechanism to temporarily freeze the service when abnormal usage is detected until manual review, as well as settings for individual API spending limits, instead of letting bills pile up endlessly.
A netizen commented not to give up too early, because in the past there have been people who encountered similar overage bills and ultimately got partial reductions or credits through repeated appeals and account manager negotiations:
However, some netizens also felt that their security measures were fundamentally wrong from the start. While they acknowledged that rotating credentials, locking down IAM, and enabling 2FA are all correct practices, the point is these should have been set up properly from the beginning—not after the bill skyrocketed.
$82,314 might not be a big deal for big tech companies, but for a small dev team of just three people, it’s enough to shut the company down—not to mention individual developers. When using APIs, you really need to be careful, especially with pay-as-you-go, unlimited pricing models.
Source: KOCPC Chinese