A friend of mine went through the same - he got an alert for bill over budget, he logged in and boom 107M$.

I was on the phone with him and we checked that he didn’t leak any APIs keys but no traffic at all. I even thought of a breach at a vendor he uses for some s3 stuff before I found this thread on HN.