The operators of the software (OpenAI "researchers") did not attempt to make purchases with someone else's crypto funds. They set (completely unrelated) goal for the LLM agents. While attempting to achieve the said goal the agents went on a series of increasingly bizarre side quests one of which required purchasing service (hosting? you can look up the details if you wish). Which required funds that LLM agents were able to obtain by hacking into crypto account(s).
So the operators did not have intent to steal the cryptocurrency.
Not that different from me requesting bank transfer through online interface and the software sending my funds to a random person somewhere. As long as the funds are refunded, everything's fine.
Now, if bank IT knew that their software kept making all kinds of bizarre mistakes and instead of fixing it continued to operate it - that would be a different story, and negligence might be at play.
So the operators did not have intent to steal the cryptocurrency.
Not that different from me requesting bank transfer through online interface and the software sending my funds to a random person somewhere. As long as the funds are refunded, everything's fine.
Now, if bank IT knew that their software kept making all kinds of bizarre mistakes and instead of fixing it continued to operate it - that would be a different story, and negligence might be at play.