The Underground Relay Market for AI API Tokens: How Resellers Get 97% Off

If you build on AI APIs, your authentication infrastructure is fighting an invisible war. A thriving gray market now resells OpenAI, Anthropic, and Google API access at up to 97.8% off official pricing -- and the ecosystem is surprisingly mature, with price-comparison sites, affiliate programs, and even a daily API-key lottery.

Matt Lenhard, a former AI gateway engineer at a major lab, published a detailed investigation on June 28 at Vectoral. He mapped a four-layer economy running out of mainland China, built on stolen credit cards, free-trial abuse, and open-source proxy software. The piece hit the front page of Hacker News with 130 points and 77 comments, and the discussion spans everything from whether this is fraud or arbitrage to what providers can actually do about it.

What the Investigation Found#

The relay market runs on four distinct layers:

Upstream -- card and account merchants (卡商/号商). These operators sell virtual credit cards designed to pass US and European billing checks, plus bulk-registered accounts. They are the raw material suppliers of the fraud economy.

Midstream -- account pools (账号池). A pool aggregates dozens or hundreds of upstream accounts, manages their authentication tokens and rate limits, handles failover when accounts get flagged, and exposes a single API surface. Some pools don't just collect lab credentials (OpenAI, Anthropic, Google) -- they also harvest tokens from application-layer tools, meaning any consumer product that resells or exposes a model is a target.

Downstream -- relays / transfer stations (中转站). These are the consumer-facing layer. They wrap the pool's API in a clean, billed product, handle invoicing, run customer-support WeChat groups, and compete on price. Almost every relay runs on one of two open-source projects: one-api or new-api. Both are OpenAI-compatible gateways that expose a single endpoint and route requests through a pool of API keys. Plenty of legitimate companies self-host these for internal team use -- the abuse comes when channels are stocked with stolen keys.

End users. Individual Chinese developers, small startups, and mid-sized SaaS companies hunting for cheap inference. Some larger commercial buyers use the infrastructure for model distillation at scale.

The discounts are staggering. The cheapest relay, 01Now Coding, offers a 97.8% discount off official pricing. A typical package: $3,333 worth of official Anthropic credit for 425 RMB -- roughly $0.13 of usage per $1 spent. The top ten relays tracked by the investigation pull a combined 3.6 million visits per month.

The methods used to source these tokens include free-trial abuse (mass-automated account creation), chargeback attacks, prepaid card exploitation, open inference abuse (proxying traffic through support chatbots), and "denial of wallet" attacks -- flooding concurrent requests purely to burn a provider's spend.

What HN Is Saying#

The Hacker News discussion split into several camps. Simon Willison linked to both one-api and new-api on GitHub -- both legitimate, popular open-source projects that happen to power most of the relay market. He found the whole thing "pretty fascinating."

WorkOS CEO Adam Griffin (grinich) commented that they run similar fraud detection for Cursor and other AI companies: "It turns out to be a pretty complex program to solve at scale. Token fraud is a lucrative market and the adversaries are surprisingly sophisticated. It's a cat-and-mouse game, accelerated with AI."

A thread participant with experience in ad-tech financial integrity (wtobey1) pointed out that none of this is novel: "The same resale markets are at play for the last generation of internet giant's products. Highly sophisticated actors, able to cobble together impressions through abuse of the billing systems, stolen financial instruments, taken over accounts."

The most pointed critique came from altmanaltman: "'Token reseller market' is a fancy way of saying credit card fraud. If someone stole Xboxes from stores using stolen credit cards and then sold them at 10% of their price, at what point is it a 'reseller market' and not 'criminal enterprise'?"

Others raised the model substitution risk. One commenter (blfr) noted: "I disabled automatic downgrading/rerouting because it sometimes takes me a second to tell when the answer came from a different model than I wanted. You could easily sell Opus as Fable for a good while." The buyer literally cannot verify they are getting what they pay for.

Why This Matters for Developers#

This is not just a provider problem. If you build on AI APIs, the relay market affects you in three concrete ways:

Your API costs subsidize the fraud. Every chargeback, stolen card, and abused free trial eventually gets priced into API rates. Providers do not eat these losses -- they recoup them through the pricing you pay. The 97.8% discount end users enjoy is effectively a tax on legitimate API consumers.

Your authentication patterns are being studied. The sophistication of relay operators means they are constantly probing billing systems, rate limits, and identity checks. The same techniques used to harvest tokens can be adapted for API abuse targeting your application. The security landscape for AI coding agents is evolving fast, and understanding these attack patterns is part of staying ahead.

The gateway software is dual-use. one-api and new-api are legitimate, well-engineered tools that many teams use for internal API management. The same features that make them useful for team quotas and spend tracking make them perfect for relay operators. If you self-host an API gateway, understanding how abuse happens helps you harden your own deployment. The Envoy AI Gateway coverage on DevDigest covers the production side of this architecture.

What Providers Can Do#

Lenhard's recommendations are pragmatic: raise the cost of account creation, flag prepaid and virtual cards, monitor for behavioral patterns that no real user produces (time from registration to first token, IP signals, model selection), cluster accounts by device fingerprint, and set up spend anomaly alerts. He also suggests quiet throttling -- a clean error tells the attacker which signal to fix.

Several comments pushed back that subscription models are the root cause. benlivengood argued: "How would one even word a bulletproof subscription contract for agentic tokens? Fixed cost per token simply works."

The HN thread also surfaced WorkOS Radar as a commercial solution already deployed at companies like Cursor. For teams evaluating their own defenses, the AI API pricing landscape and cost control patterns are directly relevant context.

The Bigger Picture#

The relay market is a symptom of structural pricing arbitrage, not just garden-variety fraud. When a provider prices tokens below market-clearing levels on one side of a geopolitical boundary and far above them on the other, an intermediary layer will emerge to capture the spread. This is the same dynamic that produced ticket touting, ad-tech resale, and every gray market in history.

The difference with AI tokens is the speed and scale. The relay software is open source, the accounts are fungible, and the traffic volumes are measured in terabytes per day. One forum operator quoted by Lenhard claimed 20 TB on their first day online. The ten highest-traffic relays tracked by the investigation pull 3.6 million visits a month combined. That is not a fringe operation -- it is a parallel distribution channel for frontier model inference.

For developers, the takeaway is practical: harden your authentication, monitor your spend, and assume that any API key you issue can end up in a pool. The agent fleet economics post on DevDigest covers what this looks like at scale, and the model routing strategies can help you build cost-aware systems that detect anomalies before they become bills.

Sources#

• Vectoral: An Inside Look at the Relay Market Powering Token Resellers and Fraud -- Matt Lenhard, June 28, 2026
• Hacker News discussion -- 130 points, 77 comments
• one-api GitHub -- open-source OpenAI-compatible gateway
• new-api GitHub -- actively maintained fork with self-service payment
• V2EX: "A comprehensive guide to AI transfer station jargon" -- primary forum thread, 35k views, 190 replies
• WorkOS Radar -- commercial AI fraud detection deployed at Cursor

Continue Reading#

• Envoy AI Gateway: LLM Production Routing -- legitimate gateway infrastructure vs relay abuse patterns
• AI Coding Tools Pricing Comparison 2026 -- what official API access actually costs
• AI Agent PMF and Cost Control -- building cost-aware agent systems
• Model Routing Recipes to Cut AI Spend -- routing strategies that also detect anomalies
• Agent Fleet Economics: Fable 5 and Sonnet 5 -- scaling cost governance across distributed agent systems