Inside the LLM Token Relay Market: Stolen Keys Behind Cut-Price Claude and GPT Access
A investigation into Chinese-language reseller forums shows how open-source LLM proxy software is repurposed to turn stolen credentials, abused free trials, and chargeback fraud into a thriving market for discounted OpenAI, Anthropic, and Google API access.
Key Takeaways
- Resellers use open-source gateway software (**one-api** and its more active fork **new-api**) to pool stolen or abused API credentials and resell access to OpenAI, Anthropic, and Google models at discounts reported as high as 97.8%.
- The supply comes from free-trial abuse, virtual cards built to dodge billing verification, leaked consumer-app credentials, and chargeback fraud — not from a single breach.
- This is a cost and abuse problem as much as a data one: one operator claimed 20TB of traffic on its first day online, and the investigation flags unprotected support chatbots as an overlooked way relays get proxied API access.
- KYC checks alone won't close this off — the underlying incentive (arbitrage on undermonitored API spend) just moves to the next weak control point.
What the investigation found
Security researcher Matt Lenhard's investigation, published on Vectoral and flagged by Simon Willison, documents an active resale market — mostly operating out of Chinese-language forums — for discounted access to major LLM APIs. The mechanism is straightforward: operators pool API keys from many sources behind an OpenAI-compatible gateway and resell metered access at a fraction of list price. The software doing the pooling is legitimate and open source — one-api (github.com/songquanpeng/one-api) and its more actively developed fork new-api (github.com/QuantumNous/new-api) — both built for the mundane task of load-balancing requests across a team's own provider keys. Repurposed at scale, they become the plumbing for a fraud economy.
Where the discounted credit actually comes from
None of this is a single hack. The investigation traces supply to several parallel abuse paths:
- Free-trial abuse at scale — bulk-registering trial accounts via card merchants (卡商) and account merchants (号商) who specialize in generating verification-bypassing identities.
- Virtual and prepaid cards engineered specifically to clear US/EU billing checks without a real payment method behind them.
- Leaked or stolen credentials pulled from consumer apps built on top of these APIs.
- Chargeback attacks — running up usage, then reversing the charge after the fact.
- Proxying through unprotected support chatbots that hold their own API access, effectively turning a customer-service bot into a free relay.
- "Denial of wallet" flooding — deliberately burning through a target's API budget.
The scale is notable: the write-up cites one operator's price-comparison listing offering $3,333 of Anthropic credit for 425 RMB (roughly $0.13 on the dollar), top relays advertising discounts up to 97.8%, the ten largest relay sites drawing a combined 3.6 million monthly visits, and one operator claiming 20TB of traffic in its first day live. A related V2EX forum thread on the topic ran from March to June 2026 and accumulated roughly 35,000 views and 190 replies.
Why this matters beyond the resale market itself
For providers and for any team that exposes an LLM-backed endpoint — a support bot, a consumer app, an internal tool with an API key behind it — this is a live abuse surface, not a hypothetical one. An unmonitored key or an unguarded chat widget isn't just a support-quality problem; it's a monetizable relay node the moment someone notices it's undermonitored. The investigation's own conclusion is blunt: KYC and identity checks on API sign-up will push this activity toward the next weak point (leaked keys, unprotected integrations) rather than eliminate it, because the underlying economics — arbitrage on someone else's API spend — don't go away.
What this means for defenders
- Treat every production integration that holds an LLM API key — including support bots and internal copilots — as a monitored production credential, not a convenience feature.
- Set hard per-key spend caps and anomaly alerts on usage volume, geography, and request patterns; a relay's traffic pattern looks nothing like a normal user's.
- Scope and rotate API keys aggressively; a key embedded in a consumer app or chatbot is a key that can leak.
- Assume free-trial and promotional-credit programs will be targeted at scale, and design abuse detection accordingly rather than treating it as noise to write off.
PyramidLedger's take
This is a good example of a class of risk we test for directly: does an application's LLM integration — chatbot, agent, or internal tool — expose API access or credentials in ways an attacker could quietly turn into a relay, and do spend caps and anomaly detection actually catch it before the bill does?
Frequently Asked Questions
What is a "token relay" in the context of LLM APIs?
It's a proxy service — usually built on open-source gateway software like `one-api` or `new-api` — that pools API keys from many sources (legitimate, abused, or stolen) and resells metered access to models such as GPT, Claude, or Gemini at a steep discount off list price.
How do resellers get discounted API access in the first place?
Per the Vectoral investigation, supply comes from abusing free trials at scale, using virtual/prepaid cards built to bypass billing verification, using leaked credentials from consumer apps, running chargeback fraud, and proxying through unprotected support chatbots that hold their own API keys.
Can KYC checks on API sign-up stop this?
The investigation argues no — identity checks raise the cost of one abuse path but push resellers toward the next weak control point, such as leaked keys or unguarded integrations, since the underlying arbitrage incentive is unchanged.
Sources
- 1An Inside Look at the Relay Market Powering Token Resellers and Fraud — Simon Willison
- 2An Inside Look at the Relay Market — Vectoral (Matt Lenhard)
- 3V2EX forum thread on the relay market — V2EX