Here is a number that does not make sense: $3,333 worth of official Anthropic API credit, sold for 425 RMB. That is roughly $59.
The buyer pays fifty-nine dollars and receives over three thousand dollars worth of API access to frontier models. The effective rate: about $0.13 of official usage per dollar spent -- a 97.8% discount off the list price.
This is not a group-buy discount or a startup perk. It is the relay market, a four-layer underground economy that has grown around AI API tokens, and it is bigger and more organized than most developers realize.
What Is a Relay?
A relay -- also called a "transfer station" in the Chinese-language forums where this economy operates -- is a service that proxies API traffic to US-hosted AI models at a deep discount. You point your OpenAI-compatible SDK at the relay's endpoint instead of the official one, and your requests get forwarded through a pool of accounts the relay operator controls.
The discount comes from the gap between what AI providers charge for API access and what these operators actually pay. If you are running stolen credit cards, bulk-registered free-trial accounts, or chargeback arbitrage, your cost per token approaches zero. Sell those tokens at 90% off list price, and you still make a healthy margin.
I run a personal AI agent infrastructure using Hermes Agent with multiple provider backends, including Anthropic and OpenAI APIs directly. When I first read about the relay market, my reaction was not moral outrage -- it was curiosity about the economics. How do you build a business model around something that should not work? The answer, it turns out, involves a surprisingly sophisticated supply chain.
The Four-Layer Economy
The relay ecosystem runs four layers deep, from the people sourcing raw credentials to the developers buying cheap inference. Matt Lenhard, a security researcher who spent years working on AI gateway abuse, documented this structure in detail after stumbling onto a Chinese-language forum where operators openly discuss their methods.
Layer 1: Card and account merchants (卡商/号商). These are the upstream suppliers. They sell virtual credit cards designed to pass US and European billing checks, along with bulk-registered AI provider accounts. Some cards are prepaid. Some are stolen. The merchants rarely care which.
Layer 2: Account pools (账号池). A pool aggregates dozens or hundreds of upstream accounts, manages their authentication tokens and rate limits, handles failover when accounts get flagged, and exposes a single API surface. The inventory is not limited to direct OpenAI, Anthropic, and Google credentials. It also includes accounts harvested from the application layer -- consumer products like Kiro and antigravity that resell or expose models underneath. To a pool operator, any token that grants model access is fair game.
Layer 3: Relays / transfer stations (中转站). These are the consumer-facing layers. They wrap the pool's API in a clean product, handle billing and invoicing, run customer-support WeChat groups, and compete on price. The relay is what an end user actually interacts with.
Layer 4: End users. The buyers include individual Chinese developers, small startups, and mid-sized SaaS companies hunting for cheap inference. A significant portion of demand comes from model distillation operations -- using cheap relayed access to frontier models to train domestic alternatives.
In practice these layers blur. Many operators run both the pool and the relay. The forum participants themselves often use the terms interchangeably.
The Software Stack
Almost every relay runs on one of two open-source projects: one-api or new-api.
Both are OpenAI-compatible gateways written in Go. An operator deploys the panel and sets up channels. Each channel represents a provider plus a pool of API keys. The panel exposes a single endpoint matching the OpenAI API format. Buyers just point their existing SDK at the relay's URL. On every request, the gateway pulls a key from the pool, forwards the request upstream, returns the response, and deducts quota priced by usage times a multiplier.
New-api is a more actively developed fork of one-api. The difference is mostly commerce: it ships with self-service payment and recharge, plus image, video, and audio model support. Across the relays tracked in Lenhard's research, one-api appears roughly four times as often as new-api, but new-api is the one built to sell.
There is nothing inherently illicit about this software. Plenty of legitimate companies self-host one-api to put their own accounts behind a single gateway with team quotas and spend tracking. A relay crosses the line when its channels are stocked with stolen, leaked, or pooled keys instead of the operator's own.
The Methods
The relay operators use several techniques to keep their costs near zero:
Free-trial abuse. Automate account creation en masse to claim free credits, then proxy that traffic to end users. This is the oldest play in the book, and it still works because AI providers need low-friction onboarding to compete.
Chargeback attacks. Run up legitimate usage, then charge back the spend after the billing cycle. The provider eats the cost. The operator keeps the tokens.
Stolen prepaid cards. Fund accounts with virtual prepaid cards that pass initial verification checks but are untraceable.
Open inference abuse. Any support chatbot or API endpoint without strict guardrails is a target for proxying traffic through it. The attacker embeds the victim's API key in their relay pool and routes requests through it.
Denial of wallet. A newer pattern: fire off a flood of concurrent requests purely to burn through a provider's spend. There is no financial motive beyond sabotage.
Lenhard notes one crucial detail in his research: the inventory is not limited to direct lab accounts. Alongside OpenAI, Anthropic, and Google credentials, the pools contain accounts harvested from consumer AI products that resell access to these models. If an app wraps a frontier model and exposes an API, that API is a target.
How Big Is This Market?
The scale is surprising for an underground economy that most US developers have never heard of.
The ten highest-traffic relays tracked by Vectoral pull a combined 3.6 million visits per month. Price-comparison sites exist for relays, listing available operators and their rates. There are affiliate programs. There is even a daily lottery.
Yes, a lottery. The site hvoy.ai, which bills itself as a relay authenticity checker, runs a daily draw for fifty $100 API keys. On the day Lenhard looked, 258 people had entered 401 tickets for those fifty keys. The draw uses a provably fair scheme -- the same cryptographic approach legitimate crypto-gambling sites use. The random seed is the hash of the latest Bitcoin block. Winners are picked with a Partial Fisher-Yates shuffle. The full entry list is published as a snapshot before every draw.
A market that has price comparison, affiliate programs, and provably fair lotteries is not a fringe operation. It is a mature gray economy with infrastructure.
Who Is Buying -- and Why
The buyers fall into three categories:
Cost-sensitive developers in regions where US API pricing is prohibitive. A solo developer in China paying $0.13 on the dollar for Anthropic access can build products that compete globally on price.
SaaS companies running inference at scale. For a startup processing millions of requests a day, the difference between official pricing and relay pricing is the difference between profitable and unprofitable.
Model distillers. This is the most strategically significant category. Cheap relayed access to frontier models makes it economically viable to run large-scale distillation pipelines -- using the output of GPT-5, Claude Opus, or Gemini to train smaller open-weight alternatives. Forum quotes in Lenhard's research claim distillers in the industry have made millions this way.
From a developer's perspective, the appeal is obvious. I pay Anthropic directly through my API account. A relay operator charging 3% of list price looks like a steal. The catch, of course, is that you have no reliability guarantee, no SLA, and no idea whether you are actually getting the model you paid for. A recurring complaint on the forums is that relays silently substitute cheaper models -- charge for Opus, deliver Sonnet -- and the buyer has no way to verify.
What This Means for the Rest of Us
If you build products on top of AI APIs, this market affects you whether you participate in it or not.
First, pricing pressure. When a significant portion of your competitors can access the same models at 3% of your API bill, you either find a moat that is not based on inference cost, or you lose. This is already playing out in the Chinese AI startup ecosystem, where relay-enabled cost advantages have fueled a wave of低价 (low-price) AI products that Western companies struggle to compete with on price.
Second, security externalities. The relay demand incentivizes fraud against AI providers -- stolen cards, mass account creation, chargeback rings. Providers pass these costs back to legitimate customers through higher prices and tighter rate limits. Every chargeback fraud incident raises the barrier for everyone. We are already seeing this: Anthropic and OpenAI have steadily tightened free-tier limits and introduced more aggressive abuse detection.
Third, distillation at scale. The ability to cheaply extract training data from frontier models via relayed access changes the competitive dynamics of open-weight AI development. A team with $10,000 in relay credits can run distillation pipelines that would cost $300,000+ at official API pricing. Whether you view this as democratization or intellectual property theft depends on your perspective, but it is happening either way.
Fourth, trust erosion. The relay market introduces a fundamental trust problem. If I am a legitimate developer running a production service on Anthropic's API, how do I know my API key has not leaked into a pool? How do I know a support chatbot I depend on is not proxying traffic through a relay? The line between legitimate multi-account management and relay participation is blurrier than the industry wants to admit.
How Providers Are Fighting Back
The defense playbook against relay fraud, as outlined by Lenhard and corroborated by discussions on Hacker News, includes:
Raise the cost of entry. Make accounts hard to create in bulk. Cap what fresh accounts can spend. Any friction raises the attacker's cost.
Watch the money. Flag prepaid cards, virtual cards, mismatched billing info, and small card-testing charges. Payment signals are harder to fake than behavioral ones.
Watch the behavior. Look for patterns no real user produces: time from registration to first token, model selection patterns, prompt relevance, account age, and IP signals (proxy, VPN, country origin).
Cluster the accounts. Watch for IP sybils and shared device fingerprints that tie supposedly separate accounts back to one operator.
Monitor for cost anomalies. Set up spend alerts as a failsafe.
The honest assessment from people working on this problem: none of these measures stop the abuse for good. Fraud in this market is a constant cat-and-mouse game. Every detection technique eventually gets bypassed. The goal is not to eliminate abuse but to make attacking your service expensive enough that the numbers stop working for the attacker.
What I Think
I have been building production systems with AI APIs for the last two years, and what struck me most about the relay market is not the fraud -- it is the infrastructure gap it exposes.
AI providers are selling a luxury good at commodity pricing. Their subscription plans offer unlimited usage for a flat fee, their free tiers give away real compute, and their API pricing has been dropping faster than cost curves justify. All of this is designed for market share, not sustainability. The relay market is what happens when financial incentives and technical controls diverge.
The honest truth is that there is no clean technical fix for this. The same API surface that makes AI accessible also makes it vulnerable to abuse. Every restriction you add to stop fraud also adds friction for legitimate users. Every identity check raises the barrier for the people who need this technology most.
For now, the relay market will keep growing. The price-comparison sites will add more operators. The daily lottery will keep drawing. And somewhere on V2EX, a developer will save his startup's runway by pointing his SDK at a relay endpoint instead of the official one, knowing full well that the $0.13 token comes with strings attached.
Primary source: "An Inside Look at the Relay Market Powering Token Resellers and Fraud" by Matt Lenhard, Vectoral Research, June 2026. Additional context from Hacker News discussion (item 49058993) and V2EX forum thread (t/1196011).
Top comments (0)