The rise of token fraud has moved far beyond the early days of free‑credit abuse where users simply created dozens of accounts to harvest trial credits. What began as a nuisance for AI gateway teams has matured into a sophisticated, multilayered underground economy that siphons billions of dollars worth of compute from major model providers. Engineers now see organized groups operating like legitimate businesses, complete with supply chains, pricing sheets, and customer support channels. This shift means that defending against abuse requires understanding not just the tactics of individual bad actors, but the entire market infrastructure that enables them to resell access at steep discounts. The following analysis breaks down each layer of this ecosystem, showing how seemingly innocuous tools are repurposed for illicit gain and why simple blocks are no longer enough.
At the foundation of the token resale market sit the card and account merchants, often referred to in Chinese forums as 卡商 and 号商. These actors specialize in producing virtual credit cards that can pass the billing checks of U.S. and European payment processors, alongside bulk‑registered accounts harvested from public sign‑up pages or leaked databases. The cards are typically funded with stolen or synthetic identities, allowing them to appear as legitimate customers when they open accounts with Anthropic, OpenAI, Google, or other AI labs. By selling these pre‑validated credentials in bulk, the merchants lower the entry cost for downstream operators who would otherwise struggle to get past Know‑Your‑Customer (KYC) hurdles. Their operations are advertised on private chat groups and forums, where reputation systems and escrow services help mitigate the risk of scams among traders.
The next tier consists of account pools, known as 账号池, which aggregate dozens or even hundreds of the upstream credentials into a single manageable resource. A pool’s primary responsibilities include authenticating each account, rotating API keys to stay within rate limits, detecting when an account has been flagged or banned, and automatically failing over to a healthy replacement. From a technical standpoint, the pool exposes a clean API surface that abstracts away the complexity of juggling many downstream connections. This layer is crucial because it smooths out the volatility inherent in relying on stolen or short‑lived accounts, providing a steady stream of tokens that downstream services can consume without needing to manage each credential individually.
Downstream from the pools sit the relay or transfer station operators, the consumer‑facing brands that turn raw token access into a purchasable product. These services wrap the pool’s API in a user‑friendly interface, often localized in Chinese, and handle billing, invoicing, and customer support via platforms like WeChat. Their main competitive lever is price: by marking up the underlying token cost only slightly, they can offer access at a fraction of the official list price—sometimes as low as $0.13 of usage per dollar spent. Many relays also provide usage dashboards, tiered plans, and API keys that mimic the official provider’s format, making it easy for developers to swap a URL in their existing code and start consuming discounted compute immediately.
At the bottom of the chain are the end users: independent Chinese developers, small startups, mid‑sized SaaS companies, and even larger enterprises engaged in model distillation. These buyers are attracted by the promise of cheap inference for prototyping, production workloads, or research experiments that would be prohibitively expensive at retail rates. Some commercial actors specifically use the relay infrastructure to train smaller domestic models by distilling the outputs of frontier models like Claude or CodeX, a practice that can generate massive traffic volumes—reports of tens of terabytes per day are not uncommon on the forums. The demand side is robust, with price‑comparison sites and affiliate programs driving steady traffic to the most popular relays.
In practice the boundaries between layers are fluid. Many operators run both an account pool and a relay, using the same infrastructure to source credentials and sell them directly. Forum participants frequently interchange the terms “pool” and “transfer station,” reflecting the integrated nature of their businesses. This blurring complicates defensive efforts because taking down a single website may not eliminate the underlying supply of tokens; the same group can simply relaunch under a new domain while retaining control of the credential pool and the billing system. Consequently, defenders need to look beyond surface‑level domain blacklists and focus on behavioral patterns that persist across rebrands.
The technical engine powering most relays is a pair of open‑source projects: one-api and its more actively maintained fork, new-api. Both provide an OpenAI‑compatible gateway that accepts incoming requests, selects an API key from a configured pool, forwards the request upstream, returns the response, and deducts usage based on a configurable multiplier. Operators simply deploy the panel, add channels representing providers and key pools, and point their users at the relay’s endpoint. While the software itself is neutral—and many legitimate companies use it to manage their own internal API consumption—its misuse occurs when the channels are stocked with stolen, leaked, or pooled keys rather than the operator’s own legitimate accounts, and when the service is marketed in violation of the providers’ terms of service.
Three primary motivations drive demand within this shadow market. First, the lure of cheap tokens allows cost‑sensitive teams to run experiments or production workloads that would otherwise be prohibitive. Second, relays often circumvent geo‑restrictions that block certain regions from accessing specific models, giving users in restricted jurisdictions a backdoor to cutting‑edge AI. Third, model distillation has emerged as a major commercial use case, where attackers harness the outputs of powerful models to train smaller, locally hosted variants. Forum posts boast of individuals earning hundreds of thousands of RMB per day through distillation pipelines, describing the activity as a multi‑billion‑RMB industry chain that rewards strong programming capabilities.
The market’s maturity is evident in the ancillary services that have sprouted around the core relay offerings. Price‑comparison sites list dozens of operators side by side, complete with historical uptime and discount metrics. Affiliate programs reward users for referring new customers, while some portals even sell gateway products that bundle multiple relays into a single failover solution. Traffic analyses show that the ten highest‑volume relays collectively attract roughly 3.6 million visits per month, indicating a user base that extends far beyond a handful of hobbyists. Perhaps most striking is the daily lottery run by a site called hvoy.ai, which purports to verify relay authenticity while giving away fifty $100 API keys each day through a provably fair draw based on Bitcoin block hashes—a clear sign that the ecosystem has normalized and gamified illicit access.
Looking ahead, the rollout of stricter KYC and identity verification measures by providers such as Anthropic will not erase the problem; instead, it will push the abuse into new vectors. Attackers are likely to shift focus toward exploiting application‑layer endpoints, leveraging reverse‑engineered clients for consumer products like Kiro or antigravity, or compromising third‑party services that already possess legitimate model access. The cat‑and‑mouse nature of fraud means that any defensive measure will be met with adaptation, making it essential for defenders to adopt a layered, cost‑increasing strategy rather than relying on a single silver bullet.
Practical defense begins with making abuse economically unattractive. Implement strict rate limiting per IP and per API key, coupled with real‑time anomaly detection that spots unusual patterns such as sudden spikes in token consumption from a single account or geographic region. Use token fingerprinting—embedding subtle, provider‑specific characteristics in responses—to identify when a key is being used outside its intended context. When abusive activity is detected, apply quiet throttling or gradual degradation rather than outright errors, which merely signal the attacker to adjust their tactics. Additionally, monitor for the reuse of known compromised credentials across multiple services and share threat intelligence with industry groups to build a collective blocklist.
Beyond technical controls, consider legal and contractual levers. Ensure that your terms of service prohibit resale or redistribution of API access, and enforce them through audits and takedown notices when violations are discovered. Work with payment processors to flag suspicious virtual card transactions that match patterns seen in the card merchant ecosystem. Finally, invest in continuous monitoring of underground forums and marketplaces to stay ahead of emerging relay brands and new abuse techniques. By raising the cost and complexity of an attack, you make the numbers stop working for the fraudsters, nudging them toward easier targets elsewhere.