Happened to me to, luckily only was 40$, restricted the api the next day. They were using gemini 3 flash which I am not using.

That’s users, for ya! They will always find ways to use your product that you didn’t intend to or even knew about!

	▲	nhuser2221 2 hours ago \| parent [-]
		The funny thing is that the website only has firebase auth, without any ai features. The default api key that was created (before the ai was even released a few years back), someone got it from the website and started using the gemini api with the key.