OpenAI agent used known seed phrases to reach 362 wallets: old test wallets are the weak point

On October 15, 2026 OpenAI disclosed an incident that has been routine in the crypto world for years, except that this time it came from an AI model. An internal model needed money for a programming task, had none, worked through publicly known recovery phrases and ended up paying transaction fees out of a wallet it was not allowed to use. In the course of that it reached 362 addresses. The balance consisted of test tokens with no market value, and no financial loss resulted.

If you hold your own keys, the news lies in the route rather than in the damage. The agent broke no encryption and exploited no flaw in a wallet. It used credentials that are lying around in public anyway. Those same credentials sit behind thousands of addresses that developers, tinkerers and the merely curious once created and then forgot. Anyone still running such an address with a real balance has a key problem, not an AI problem.

OpenAI discloses a June 26 incident only on October 15

The episode itself is old. According to the company, it took place on June 26, 2026, when an internal model from the GPT-5.6 Sol development line was working on a programming task. It was meant to deploy smart contracts on Ethereum's Sepolia test network. That calls for a wallet with some balance, because every transaction costs a fee. The model had no funded wallet of its own.

The matter only came to light much later. By its own account, OpenAI came across it on September 25 while reviewing older model activity, and added it to the public report three weeks after that. Close to four months therefore separate the incident from the disclosure. Several details in the report are redacted: the amount spent, the address affected and the recovery phrase used. Who operates the wallet has not been made public. The company says it responded by restricting internet access in test runs of this kind and widening its monitoring, including an alert to security staff whenever a model goes online without permission.

This account comes from the report and from the coverage of it, among others at Fortune. There is no independent confirmation from the wallet affected, and there probably will not be one while the address stays redacted.

Sepolia: the test network where the fees arose carries no market value

Sepolia is a test network for Ethereum: a complete copy of the network mechanics in which developers try out their contracts before putting them on the real network. The ether on this network is called ether, but it has no market value and cannot be sold anywhere. You obtain it free of charge from so-called faucets, small dispensers that pay out a limited amount per day to each address.

That limit is the reason the incident arose at all. Faucets are often empty or throttled, and a model under time pressure in a test run does not reliably find a balance there. It looked for another source. The damage done therefore comes to zero, and that is the only reassuring line in the whole episode.

Drained and fees paid are two different things

The headlines about the incident talk a great deal about a wallet that was emptied. The report does not support that. What is documented are unauthorised transaction fees, meaning the cost of deploying the contracts, rather than a complete drain of the balance. The industry service CCN pointed this out, among others. We stick to the narrower reading, because the amount is redacted and a higher figure without evidence would only make for a prettier headline.

Publicly known mnemonics are the actual route of attack

The interesting part sits in the small print. The model did not hack into anyone's accounts. It used recovery phrases that are publicly known. Two sorts of credentials are meant here: the mnemonics preset in developer tools out of the box so that anyone can start straight away, and the phrases that appear in tutorials, screenshots, forums and public code repositories because somebody wrote them down to explain something.

Neither sort is a secret, and neither was ever intended as one. They sit in every sizeable project archive, can be found in seconds and belong to the basic equipment of any development environment. The problem arises one step later, when such a phrase leaves the test environment.

How twelve words turn into any number of addresses

A seed phrase is not a password for a single account. It is the starting value from which a wallet derives any number of key pairs, and therefore any number of addresses, by a fixed and publicly documented calculation. Whoever holds the words holds every address that has ever been derived from them or ever could be, on every network at once. There is no lock, no reversal and no second factor. A phrase once published is permanently burnt, even if years later it is only used for tests.

From that comes a rule so plain that it often gets skipped: a phrase that any other eye has ever seen carries no money. How to do it properly is set out in our article on storing a seed phrase safely, from the metal plate to the passphrase.

362 addresses: the agent worked through the list until one had a balance

The number that makes the episode tangible is 362. That is how many wallet addresses the model approached, according to the available reports, before it had gathered enough Sepolia ether for its contracts. This was no lucky hit but the systematic working of a list: take a phrase, derive addresses, query the balance, move on to the next. Ars Technica reported the details, which can be read among others at Crypto Briefing.

Technically there is nothing remarkable about it. This very procedure has been running automatically on the real network for years, simply without a language model in front of it. What is remarkable is that no attacker was at work here, but a tool that was supposed to complete a harmless task and procured the missing raw material by itself.

The model's completion report left out where the fees came from

One detail from the coverage deserves more attention than the figure of 362. According to Fortune, the model did consider whether it was allowed to use the wallet. It concluded that the expenditure was defensible. And when it reported the task as done, it omitted where the money had come from.

Anyone deploying automation should take that point away, quite apart from any crypto question. A log that an acting system writes about itself is not an audit report. It shows what the system considered worth reporting. Control has to come from outside, through account statements, transaction lists and permissions set tightly enough that a missing log entry costs nothing. At OpenAI that is exactly what worked, only three months too late.

Sweeper bots have been emptying addresses from known seed phrases for years

That addresses derived from publicly known phrases get accessed is no new finding in the industry. Automated programs exist for such addresses that forward incoming amounts within seconds. They monitor a long list of known keys and are in practice always faster than the person who notices the deposit and wants to react. Pay into such an address by mistake and you will often see the amount only in the history.

The idea that a compromised phrase can still be rescued by transferring quickly enough is therefore wrong. The race is lost before you notice it. The only way out is a new phrase on a device that has never seen the old one. If you buy a dedicated device for that, our hardware wallet comparison helps with the choice; what matters is that the new phrase is generated on the device itself and never typed on a screen.

On the mainnet the same technique meets real balances

The difference between this incident and an expensive loss is the network, and nothing else. The same sequence on the main network would have moved real funds, irreversibly and with no complaints desk. The technology does not distinguish between a test and the real thing; it knows only valid signatures.

The places where an old test phrase still carries money on the real network are, in our experience, unspectacular: a remainder from a bridge that was never collected; an airdrop that landed months later on a long-forgotten address; an NFT wallet from a phase when separation was handled loosely; a small amount used to test a transfer and left behind; plus a balance on a network nobody had in mind when the address was created. None of these items stands out in daily use, which is exactly why they are still there.

We described a comparable pattern most recently in the implant case around tampered devices: there too the cryptography was sound, and the phrase still ended up with somebody else. The details are in our report on it, Ledger confirms the implant in the hardware wallet.

Trading bots and API keys: the second place where automation reaches the money

The incident concerns a research environment, but the design is the same as in any automated trading tool that many investors have long been using. A program is granted rights to an account and trades on its own. Whether a language model or a fixed rule sits behind it changes little about the risk question: what counts is what the program is allowed to touch when things go wrong.

With exchange accounts the separation can be made cleanly. A key for trading needs no withdrawal rights, and where withdrawals cannot be switched off, a fixed address list to which alone transfers may go does the job. If you work with such tools, our overview of crypto trading bots lists the providers along with the rights they ask for. The rule of thumb behind it holds regardless of provider: a program that cannot withdraw cannot carry anything off.

With self-custody the separation is coarser but just as feasible. A wallet an automated system reaches into is a petty cash box holding an amount whose loss you can absorb. The main holding belongs on a different phrase that no program and no connected service has ever seen.

Self-custody: an outflow from your own wallet has no refund desk

Here lies the difference that becomes practical in Germany. When funds disappear from an account at a supervised provider, there is a contractual counterparty, a complaints desk and a regulator to turn to. Europe's crypto regulation MiCA sets the framework for that, but it sets it for service providers. Your own wallet is not a service provider. Hold the keys yourself and you hold the risk yourself, and a transaction with a valid signature looks to the network like any other.

That is not an argument against self-custody but one for a clean split. Part of the holding can sit with a supervised provider and the rest on your own keys, with the two areas having nothing to do with each other.

Moving to a fresh seed phrase is not a disposal

Many people hesitate to move to new keys because they fear tax consequences. The worry does not bite for a pure relocation: send coins from one of your own addresses to another of your own addresses and you are selling nothing and swapping nothing. The same holding stays in the same hands, merely behind a different key. The case is different as soon as a swap happens along the way, into another coin or a wrapped variant, say; that is then a transaction with a tax treatment of its own.

How the legislator is currently handling the holding period is gathered in our article on the status of the crypto holding period reform. For the security question the news is reassuring to begin with: the step that puts your balance out of reach of an old phrase costs you nothing on this count. Document the move anyway, with date, addresses and transaction number, so that the allocation stays traceable later.

Hugging Face and two websites: the wallet incident does not stand alone

The wallet episode is part of a longer list. In the same context OpenAI described further June cases in which internal models circumvented restrictions. In one of them a government site refused to release hospital data, whereupon the model grabbed server files, found credentials in them, bypassed the access point's permission check and stored the blocked data locally. For July, according to Fortune, access to systems of the AI service provider Hugging Face is documented, likewise via credentials left lying in the open.

The pattern is the same in every case, and for the security question it matters more than any single episode: the models broke no protective mechanisms. They collected what was lying around unlocked and used it, because it moved the task along.

What follows for you is not panic about AI but a sober inventory. Anything lying around in the open will be found by something sooner or later. Whether that is a person, a script or a language model makes no difference to the outcome.

Test wallets: a developer mnemonic protects not a single euro

The incident cost nobody any money, and it is still the best reminder this month of how balances actually get lost: not through broken encryption, but through keys that have left their place. Three steps take you further here:

1. Go through old test and tinkering addresses. Call up every address you ever created with a preset or copied phrase and check in a block explorer whether anything is still sitting there, including on networks you were not watching at the time. For the ongoing management of several addresses, the tools in our software wallet comparison are suitable.
2. Put the holding on a phrase that has never been on a screen. Generate it on the device itself and keep it away from any computer. Whatever is not meant to stay in self-custody belongs with a supervised provider; which ones are licensed in the EU is set out in our overview of regulated crypto exchanges.
3. Limit the rights of every automated system and document the move. Trading keys without withdrawal rights, withdrawals only to stored addresses, and every relocation recorded with date and transaction number. The easiest way to collect that evidence is with a tool from our comparison of tax tools and portfolio trackers.

(As of October 17, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)