An Inside Look at the Relay Market Powering Token Resellers and Fraud

Originally posted on June 28, 2026, updated on October 1, 2026.

I first ran into token fraud as a software engineer at a cloud platform and developer tools company. In April 2026, someone opened accounts in bulk to farm our free credits and ran up about $40,000 in usage. A few weeks later, they found the endpoint behind our support chatbot and pushed another $60,000 of traffic through it.

When I compared notes with engineers at other companies, I heard versions of the same story.

None of this was new. In April 2023, a Reddit user posting as ikingrpg shared a screenshot of an OpenAI notice saying they had hit their $120 hard limit on API usage, with the caption "It seems someone has stole my API key…"

Two months later, Joseph Cox, then a reporter at VICE's Motherboard and now a co-founder of 404 Media, reported that members of the r/ChatGPT Discord were advertising OpenAI API keys scraped from other people's code, much of it posted publicly on Replit. In one case, a stolen account with a $150,000 usage limit was being given away through a website and a second Discord server with more than 500 members.

What hit my company looked like the retail end of an organized market. While tracing where our abusers came from, I found a thread on V2EX, a Chinese developer forum, where relay operators openly discussed how they source, pool and resell access to American models. Our team at Vectoral decided to map 49 such relays to understand this market more deeply.

The market works like a four-layer supply chain. Vendors sell virtual cards and bulk-registered accounts. Pools stitch large numbers of those accounts into a single API, and Chinese-language “transfer stations” resell that access at a steep markdown to developers at the end of the chain. Of the 49 relays we tracked, the cheapest, Now Coding, sells at a median 97.8% off official prices. Nearly all of them run on one of two open-source gateway programs. The ten busiest relays draw a combined 3.6 million visits a month. Their customers include developers looking for cheap inference and buyers getting around geo-restrictions. Operators on the forum also claim some buyers use the access to distill American models into Chinese ones. The market is organized enough to support price-comparison sites, affiliate programs, and a directory that raffles off fifty API keys it says are worth $100 each.

That market matters more now than it did a few months ago. On September 23, Sen. Bernie Sanders and Rep. Greg Casar introduced the Ban Artificial Superintelligence Act, which would pause advanced AI development and direct the U.S. to pursue export controls and international agreements to stop superintelligence from being built anywhere. Whatever happens to the bill, any policy that depends on controlling who can use frontier models will run into a market built partly to get around those controls.

What Is a Relay?

A relay, or “transfer station” (中转站), is a middleman that resells access to American AI models to users in China who can't easily buy it directly. In the thread's opening post, v2exgo, who runs terminal.pub, describes relays as services that get around foreign geographic and payment blocks, like credit card restrictions and IP bans, so users in China can call models such as Claude, Codex and Gemini.

To a buyer, a relay looks like any other API provider. You top up an account, get a key, and point your code at the relay's address instead of Anthropic's or OpenAI's. Behind that address, the relay forwards each request to the real model through accounts sourced further up the supply chain.

Relays price in their own currency. They sell credit in dollars (刀), but v2exgo explains that a relay dollar is a virtual unit, usually sold for about 1 RMB and sometimes less. Each channel, a relay's route to a particular upstream supply, then applies a multiplier that sets how much relay credit a request burns compared with the official price. In v2exgo's own example, at 1 RMB per relay dollar, a channel with a 0.3 multiplier means 0.3 RMB buys what would cost $1 at official prices.

That's how the discounts get so steep. In one reply, a user posted a monthly plan priced at 425 RMB, capped at $500 in relay credit, which the relay said was equivalent to $3,333 of official usage.

That's how the discounts get so steep. In one reply, a user named bojue listed a monthly plan priced at 425 RMB, capped at $500 in relay credit, which the plan said was equivalent to $3,333 of official usage. bojue said he couldn't make sense of how that compared with official pricing.

milkleeeeee, who runs the price-comparison site getcheapai.com, explained it: the plan came to 0.13 RMB per $1 of official credit. At [RATE] RMB to the dollar on [DATE], that means the buyer pays roughly 2 cents for each dollar of official usage, a discount of about 98%. milkleeeeee added that bojue's own purchase, 500 RMB for $640 of official credit, came to 0.78 RMB per dollar, which milkleeeeee called relatively expensive for a monthly plan.

Operators in the thread say the cheap supply depends on refunds. According to v2exgo and another user, when Anthropic bans an account for reselling Claude Code access, it refunds the subscription in full, so a pool's main cost is the virtual card used to open the account.

v2exgo's reply #9 in the V2EX thread (translated).

As of June 28, 2026, median discounts across the 49 relays ranged from 8.1% to 97.8%. The cheapest was Now Coding:

How the Market Works

In the thread’s opening post, v2exgo lays out the supply chain in three tiers under the label "CCMAX," shorthand for running Claude Code on Anthropic's Max subscription.

We split his middle tier in two, because pools and relays do different jobs, which gives four layers, from the merchants sourcing raw accounts to the developers buying cheap tokens:

1. Card and account merchants (卡商 / 号商): At the top are sellers of virtual credit cards and bulk-registered accounts. They earn fees on the cards or profit from registering accounts in bulk. Some accounts come from automated sign-up tools. v2exgo says OpenAI accounts could be registered nearly for free using open-source registration bots shared on another forum.

   

2. Account pools (号池): Pools hold large numbers of those accounts and sell the capacity to relays. Their margin depends on the refunds described above. v2exgo says the large pools have millions of RMB tied up in accounts.
3. Relays, or transfer stations (中转站): These are the storefronts. According to v2exgo, relays profit from the spread, using the size of their customer base to push pools for lower prices. They run like ordinary software businesses. v2exgo's own relay offers invoices and a business sales team (replies #29, #100), and within 12 days of his post it had opened 11 WeChat groups for customers.
4. End users: Buyers include individual developers and companies. According to v2exgo, some established relays serve only distillation customers.

Many operators run both the pool and the relay, and the forum’s own participants often use “pool” and “transfer station” interchangeably. At least one relay offers white-label service, suggesting it may control its own supply.

Almost every relay we tracked in this investigation runs on one of two open-source projects: one-api or new-api. Published on GitHub by a developer who goes by songquanpeng, one-api describes itself as a system for managing LLM API keys and redistributing them. It puts OpenAI, Anthropic, Google and a long list of Chinese models behind a single OpenAI-style interface.

An operator installs the panel and adds channels, each one a provider plus a set of keys. Buyers get a key from the relay and point their existing code at the relay’s address. The panel spreads requests across the available channels and charges each one against the buyer’s balance using group and model multipliers.

new-api, maintained by QuantumNous, is built on one-api and can run on its database directly. It has also overtaken its parent on GitHub, with about 49,000 stars against one-api's 37,000.

There’s nothing inherently illicit about the software. Plenty of companies self-host these tools to put their own accounts behind a single gateway with team quotas and spend tracking. A relay crosses the line when its channels are stocked with stolen, leaked, or fraudulently registered accounts instead of the operator’s own, and when it resells that access against the providers’ terms.

How Abusers Get Access

The accounts and credits that relays resell have to come from somewhere. In my experience and what other engineers described, abusers get access they don't pay for in four main ways:

• Free-trial abuse. Abusers script account creation at scale to collect free credits, then route that usage to their own customers.
• Chargebacks and stolen cards. Some abusers pay with real cards, use the credits, then dispute the charges with their bank after the billing period ends. Others pay with stolen cards from the start. Either way, the provider absorbs the cost.
• Prepaid and virtual cards. Abusers fund accounts with prepaid or virtual cards carrying small balances. These are the kinds of cards sold by the merchants at the top of the supply chain.
• Open inference endpoints. Any public-facing AI feature that doesn't restrict what users can ask, like a support chatbot, works as a free model endpoint. Abusers route relay traffic through it. That's how the second attack on my company worked.

A related threat falls outside the relay market. In a denial-of-wallet attack, someone floods a provider with concurrent requests to run up its bill without using the output. The defenses below can be used to shield against it.

Buyers in an Expanding Market

Buyers in the thread come to relays for three reasons: price, access and, according to some operators, distillation.

Price. Most of the V2EX thread is about cost. Individual developers compare per-dollar rates across relays, and companies buy in bulk. One commenter said their company spends $200 a day on GPT. Another was buying for internal company use and asked for per-key spending controls.

Access. Anthropic, like OpenAI and Google, does not offer commercial access to Claude in China. Relays exist largely to get around restrictions like that, which is how v2exgo defines them in his opening post.

Distillation. The most serious claim in the thread is also the hardest to verify. Distillation means training one model on another model's outputs. v2exgo wrote:

“Distillation uses Claude/CodeX models to train domestic models. There are intermediaries that specialize in distillation and can provide relevant evidence, but I can’t name specific domestic companies. Anyway, companies with strong programming capabilities are all distilling Claude; it’s a multi-billion RMB industry chain, and many big players earn hundreds of thousands a day.”

When another user questioned this characterization, v2exgo replied:

“It’s not just true — many distillers in the industry have made millions.”

v2exgo, who has a stake in how big this market looks, offered no evidence, and we could not verify his claims. But the setup he describes matches what Anthropic reported in February. The company said three Chinese labs, DeepSeek, Moonshot and MiniMax, generated more than 16 million exchanges with Claude through about 24,000 fraudulent accounts, using proxy services to evade detection.

Anthropic described those services as commercial proxies that resell access to Claude and other frontier models at scale. In one case, it said, a single proxy network ran more than 20,000 accounts at once, mixing distillation traffic with ordinary customer requests.

That is also how a relay works: many accounts behind one endpoint, serving many customers at once.

The market around these buyers is already well organized. There are price-comparison sites like getcheapai.com, affiliate programs, and directories that rate relays for authenticity. v2exgo's own relay opened 11 WeChat groups for customers within 12 days of his post. The ten highest-traffic relays we track draw a combined 3.6 million visits a month, according to estimates from Bishopi.

They’re Raffling Off Keys Now

A clear sign of how normalized this has become is that one of the relay directories runs a daily lottery for API keys.

hvoya.comi, which otherwise bills itself as a relay authenticity checker and price-comparison tool, gives away fifty $100 API keys every day. You earn entry credits from a daily check-in, spend 20 credits per ticket, and can buy up to three tickets a round. The site shows how many people participated in the lottery, how many keys are still up for grabs and how many tickets are competing for those keys.

Like many crypto-gambling sites, the draw is “provably fair.” This means anyone can check afterward that the result wasn’t rigged. It works in three steps. First, before the draw, the site publishes the full list of entries, so it can't quietly add or remove names later.

Second, it needs a random number nobody could have known in advance, so it uses the ID of the newest block on the Bitcoin network. Bitcoin produces a new block roughly every 10 minutes, and each one comes with a long, unpredictable code.

Third, the site feeds that code into a standard shuffling method, a Partial Fisher-Yates shuffle, which is the digital equivalent of shuffling a deck and dealing the top 50 cards.

In other words, a directory that steers buyers toward relays has gone to real lengths to prove its giveaway is honest.

Providers are pushing back. Anthropic says it has tightened verification for educational, research and startup accounts, the pathways most often exploited to create fraudulent ones. As providers add identity checks like these, the abuse won't disappear. It will move somewhere else, likely toward application-layer products like support chatbots that sit on top of the models.

How Providers Can Defend Themselves

There's no clean fix. Every defense below can be beaten, and the market adapts fast. On V2EX, operators describe prices moving day to day as providers ban accounts and change refund policies. The realistic goal is to make abuse cost more than it pays.

Vectoral was built to catch resellers before they bleed your bill. We look at behavioral fingerprints, deploy request-graph clustering, and monitor abuse-network intelligence flag reseller traffic the moment it routes through our clients’ endpoints.

What follows is what has worked for our team, and these recommendations will evolve with the abuse:

• Raise the cost of entry (preventing bulk sign-ups). This is how free-trial abuse takes place. Make accounts harder to create in bulk and cap what a new account can spend. Check for signs of browser automation. Any client-side check can be bypassed, but every bit of friction raises the attacker’s cost.
• Watch the money (chargebacks, stolen cards, prepaid and virtual cards). Flag prepaid and virtual cards, mismatched billing details, and small test charges, which fraudsters use to check whether a stolen card works.
• Lock down AI features (open inference endpoints). Limit what a support chatbot will answer, cap response length, and require a login before it does real work.
• Find the coordinated accounts (pools and proxy networks). The pools on V2EX and the proxy networks Anthropic described share a weakness: many accounts lead back to one operator. Look for accounts that share IP addresses, device fingerprints or payment methods. Also look for behavior real users don't produce: how quickly a new account starts using tokens, which model it picks, whether its prompts fit your product, and whether it connects through a proxy or VPN.
• Cap the damage (all of the above, plus denial-of-wallet). Assume some abuse gets through. Set spend caps and concurrency limits per account. Reserve budget for each request in progress, so simultaneous calls can't blow past a limit. Start new accounts with low limits and raise them with age and a verified card. Add friction like a CAPTCHA or ID check when an account's risk rises mid-session. Set alerts on spending spikes so you can shut things off fast.

When you do catch someone, throttle quietly. A clear error message tells the attacker which signal to fix before they come back.

None of this ends the market. It makes one provider a worse target, and the abuse moves to the next. Anthropic's report describes a version of the same pattern: when one account is banned, another takes its place.

Relays exist because demand for American models in China is real and official access is restricted, and the traffic figures and the forum's own price wars suggest that demand is large. As long as that holds, enforcement by individual companies will push the market around rather than shut it down. Any policy that depends on controlling who uses frontier models, from Anthropic's own regional restrictions to the export controls the Sanders-Casar bill calls for, will have to reckon with it.

Read our methodology post for this blog here.