They might have spent next to 0 time actually 'hacking' - they may have just told Opencode to hack Opencode website and let it run for hours or days till it succeeded.

API keys have been routinely stolen in mass automated attacks for malicious usage long before LLMs even existed

Similar to other stolen goods, it's not hard to resell tokens on the black market: https://vectoral.com/blog/token-relay-market

If the keys were used for a black market resell, the model is less important and all tokens would have been valuable, but certainly more expensive tokens earn the hacker more money over the same time frame.