Bots fought over the OpenAI Sepolia testnet wallet. It changed hands 126 times in 14 hours.

01 · A wallet anyone can open

What OpenAI reported, and what it left out

OpenAI says one of its AI models spent money that was not its own. It was test money, on a practice copy of Ethereum. The model got in with a password anyone can look up.

The company wrote the case up in its misalignment reports, a series about times its models did things nobody asked them to do. A research model was told to update a trading app and deploy it on Sepolia, the testnet where developers try code before it touches real money. It needed test ETH to pay for gas, the fee every transaction pays, and it had none.

So it went looking. It tried recovery phrases that developers use as shared defaults, found an account with a balance, paid with it, and reported the job done. It never said where the money came from.

A recovery phrase, or seed phrase, is the list of words a wallet is built from. Whoever has the words controls the money. These phrases ship inside open-source developer tools, so the accounts they make belong, in practice, to everyone.

OpenAI blanked out the address and the transaction hash. It did leave clues: the date, ten contracts, and three tokens named vBTC, vETH and vUSD. The X user @apoorveth used them to find the transaction and the wallet, 0xaCcf…d578. @apoorveth traced the key to Celo's version of ganache-cli, a tool for running a private test chain. The same phrase is also the default test seed in the 0x Project's developer tools.

We checked @apoorveth's work and it holds. The twentieth account the phrase produces is this address. Its one Sepolia transaction on 26 June created ten contracts, and three of them are tokens called vUSD, vBTC and vETH.

Then we took the next step. Bitquery indexes every transaction on Ethereum, so we looked at the same address on mainnet. Until the early hours of 16 October it had never been used there. By that evening two dozen bots were fighting over it, control had changed hands more than a hundred times, and it was empty again.

The money that started the fight came from a meme coin named after OpenAI. All figures run to block 26,206,536, at 17:16:59 UTC on 16 October. The bots had not stopped by then.

02 · Why a public key draws bots

Sweepers, and a new way to take over a wallet

A wallet with a public seed is a trap with the door open. Anyone can sign for it, so people run sweeper bots: programs that watch such accounts and move funds out the moment they land. The fastest bot keeps the money.

Since Ethereum's Pectra upgrade in May 2025 there is a bigger prize. EIP-7702 lets an ordinary wallet borrow the code of a smart contract, a program that runs on the chain, by signing a short authorization. Once a bot points the wallet at its own contract, that code can sweep anything the wallet receives. Whoever holds the key can sign a new authorization at any time and point the wallet somewhere else.

Every authorization has to carry the wallet's current nonce, the counter Ethereum keeps of what an account has done. A bot can pack several into one transaction with numbers in a row, and each one applies in turn. When two bots aim for the same number, the first into a block wins and the other is skipped. We count the fight by hand-overs: each time control passes to a different bot.

Other accounts from the same seed already live like this. The first, second, sixth and eleventh accounts point at delegated code on mainnet today, and money has passed through some of them since 2017. The twentieth, the one OpenAI's model used, had no history on mainnet at all. There was nothing on it to take. We have written before about wallets whose keys sat with someone else, and about thieves who race each other to the same open door.

03 · A coin called OpenAI

The money that woke the wallet up

At 03:21:11 UTC on 16 October, the address 0x6365…0d59 launched a token named OpenAI, ticker OPENAI, in one transaction through a token factory contract named SendItFactory. The launch call sets the address that collects the coin's trading fees. That address is the OpenAI model's test wallet.

The coin trades in a Uniswap v4 pool that takes a small fee on every swap. A hook attached to the pool, a contract that runs on each trade, splits the fee: 70% to the address named at launch, 30% to the factory's platform address. We checked the split on 25 trades picked at random, and it held on every one. The launching address also bought about 5% of the supply in the same transaction.

Why point a coin's fees at a wallet anyone can drain? It could be a joke about the news, a bet that the name alone would pull in buyers, or something else. The chain does not say. We found no direct transfers between the launcher and any of the bots, and none of the addresses we checked carries a label in our records.

What the chain does show is the timing. OpenAI's report was last updated on 15 October. The coin went live the next morning, about six and a half hours before @apoorveth's post. Whoever launched it had tied the report to this address before that post, or made a lucky guess.

04 · Twelve seconds

126 hand-overs, half of them before 04:00

The first fee landed in the launch transaction itself. Twelve seconds later, at 03:21:23, the first bot took control, with a batch of five authorizations in one transaction.

The coin's buyers came fast and left fast. Ninety percent of all its fees arrived within 22 minutes of launch, and the bots chased every one. Of the 126 hand-overs, 61 happened before 04:00 UTC.

After that came a trickle: a few hand-overs an hour, often a bot grabbing back control another bot had just won. The fees had mostly stopped, but the fight over the empty wallet went on into the evening.

05 · The race

Most attempts lost

Taking control was the hard part. Of all the authorizations the bots sent, 63% were skipped because their nonce had already been used. The leading bot, 0x34f4…404f, fired them in batches of five numbers in a row. It got 502 applied, took control 25 times, and sent its take to a single address, 0x8cd8…bd18. The runner-up, 0xdca9…ba21, sent its authorizations six at a time, and 190 of its 199 went through.

The table counts the bots that got at least one authorization applied. Another eight sent authorizations and never got one through. ETH moved out by transactions the wallet signed itself, 0.0167 ETH, is not in any bot's row, because the chain does not say which bot held the key at that moment.

06 · Where $640 went

Fees in, bots and gas out

The money balances: what came in equals what went out plus gas. Most of what came in was the coin's fees. What went out went two ways: to the bots, and to gas.

The gas is the odd part. Whoever held control at a given moment could also sign ordinary transactions with the wallet's own key, and each one paid its gas out of the wallet's balance. That burned a third of everything that came in. The bots also spent their own money on authorizations, and 168 of their transactions failed outright.

At ETH's price on the day, about $2,450, the fees were worth about $640. The two leading bots moved out about $360 between them. The account was empty at our cutoff.

07 · What this does not show

The limits of the evidence

Nobody lost money they already held there. The address had no money on mainnet before the coin's first fee. What the bots took had all arrived that day: the coin's fees, plus a small amount from other senders.

We cannot say who launched the coin or why, and we cannot link the launcher to any bot. The link between OpenAI's report and the launch is timing. It is strong timing, but timing is all it is.

The Sepolia side has a limit too. The account was busy there from 5 June to 1 July, and every transaction it sent was signed with the same shared key. The chain cannot tell us how many people were behind them. Only the 26 June deployment matches OpenAI's description.

08 · Method

How we counted

We derived the address from the public seed ourselves, account index 19 on the standard Ethereum path, and matched it to the Sepolia transaction. On mainnet we counted applied authorizations two ways: from Etherscan's list of EIP-7702 authorizations, and by replaying the nonce rule over every block they appear in. Both give 815 applied, in 232 transactions, and both land on the same final nonce, 886. A hand-over is an applied authorization sent by a different bot than the one before it.

The money comes from Bitquery's Ethereum index and a public block explorer, and both give the same totals. Money in minus money out equals the gas the wallet paid. The same approach traced the much larger Ledger CryptoBilis drain earlier this month. The full history of Ethereum transfers behind these checks is also sold as files.

09 · The record

The dates and addresses behind the story

If you ever used a default developer account for anything, treat its key as public. On a busy chain, a public wallet stays empty only until someone pays it.