Matt Lenhard found 49 relays reselling OpenAI and Anthropic tokens. The cheapest runs 97.8% below list.

Matt Lenhard went hunting for whoever was abusing his AI gateway and found an industry. His investigation, published June 28 and picked up by Simon Willison on Sunday, maps 49 Chinese resale services that pool API keys behind a single endpoint and sell frontier-model access at up to 97.8% below list price.

Cheap frontier tokens have circulated in developer group chats for a while now. The plumbing underneath is the part worth understanding. Every one of these services works because the OpenAI-compatible API has become the industry’s universal socket: point a client at a different base URL, keep the same SDK, and nothing else in the code changes. That single property lets a pile of borrowed credentials present itself as a provider. Anyone who has wondered where an API key goes after it leaks out of a public repo now has one answer.

What a relay actually is

Lenhard calls it a relay, or “transfer station” in the operators’ own Chinese, and defines it as “essentially a service that proxies traffic to U.S. models, often at a deep discount.” The market he describes runs four layers deep. At the top sits a carding and account-merchant layer selling virtual cards built to clear US and European billing checks, alongside bulk-registered accounts. In the middle, account pools aggregate hundreds of those accounts, manage their tokens and rate limits, fail over when one gets flagged, and expose a single API. Relays wrap that pool in a billed, Chinese-language product with customer support running through WeChat groups. Individual developers, startups and mid-sized SaaS companies buy at the bottom.

Nearly every relay Lenhard looked at runs one of two open-source gateways: one-api, or new-api, a more actively developed fork with self-service payments bolted on. Both are legitimate. Plenty of companies self-host them to put their own accounts behind one door with team quotas and spend tracking. An operator deploys the panel and adds channels, where each channel holds a provider plus a pool of keys. The panel speaks the OpenAI API, so a buyer changes one line of config. On every request it pulls a key from the pool, forwards it upstream, returns the response, and deducts quota at usage times a multiplier. Across the relays Lenhard tracks, one-api turns up roughly four times as often as new-api. “There’s nothing inherently illicit about the software,” he writes. “A relay crosses the line when its channels are stocked with stolen, leaked, or pooled keys instead of the operator’s own.”

Supply reaches those channels by several routes, and only some involve outright theft. Automated signups harvest free credits at scale. Chargebacks claw back the spend after the usage has already been delivered. Prepaid and virtual cards fund accounts nobody ever intended to pay for. Any support chatbot without hard guardrails can have traffic proxied straight through it. The pools also reach past lab APIs into consumer coding tools, because to a pool a token is a token whatever wrapper produced it. Lenhard flags one variant with no profit motive at all, denial of wallet, where attackers fire concurrent requests purely to burn a target’s budget.

The numbers behind the discount

The most-quoted figure in the piece is a listing that bought the equivalent of $3,333 in official Anthropic credit for 425 RMB. Lenhard ranks 49 relays by median discount off list price: the cheapest runs 97.8% under official pricing, and the tenth-placed operator still runs 94.1% under it. The ten highest-traffic relays pull a combined 3.6 million visits a month between them. These are not back-alley operations. The market has price-comparison sites, affiliate programs, and one directory that raffles off fifty $100 API keys every single day, settled with a Bitcoin block hash as the random seed. Lenhard’s line about that ritual: “The part that got me is the fairness theater.”

One number in the writeup doesn’t hold up, and its author said so first. He described the effective rate as “$0.13 of usage per $1 spent,” which reads backwards, and Hacker News caught it fast. “Yeah, I should probably clean this up,” Lenhard replied in the thread. “The sentence is a bit hard to understand. What I was trying to show was the steep discounts offered by resellers.” The discount percentages and the RMB package price are the figures to work from.

His primary source is a V2EX thread in that site’s Programmers section, started in March by an operator and running to roughly 190 replies and 35,000 views by late June. Buyers show up for cheap inference, for getting around geo-restrictions, and for model distillation. One reply, translated in the investigation, claims that “companies with strong programming capabilities are all distilling Claude; it’s a multi-billion RMB industry chain, and many big players earn hundreds of thousands a day.” That’s an anonymous forum poster rather than a filing, and it deserves to be read that way.

Who eats the loss

Three groups pay for this and none of them signed up. Start with whoever owns the leaked key. Sysdig’s threat research team named that pattern LLMjacking in May 2024, after watching attackers pull cloud credentials off a server running a vulnerable Laravel build and use them to reach Claude models on Bedrock. Sysdig put the ceiling at “over $46,000 of LLM consumption costs per day for the victim” if the attacker maxed out quota across regions. The account holder gets the invoice. The relay customer gets tokens at a few percent of list.

Providers absorb the rest, and their paying customers absorb it after that. “The abuse is factored in to pricing and quota structure,” wrote one commenter with subscription-billing experience in the Hacker News thread, which drew close to 200 points and more than 120 comments. Whether any of this counts as fraud split that discussion cleanly in half. “‘Token reseller market’ is a fancy way of saying credit card fraud,” one reader argued. Another pushed back: “This is mere breach of contract, whether it’s wrong depends on the contract.” Almost nobody claimed the cost lands nowhere.

None of the machinery here is new. It’s the same pipeline that has fed on leaked secrets for years, now aimed at a commodity with an instant resale price. A Hanwha Vision camera shipped a live GitHub admin token in its login page three days ago, handing it to every operator who opened the admin UI. Back in April, Aikido found npm and PyPI packages that turned dev servers into OpenAI-compatible routers pushing Claude, GPT and Gemini traffic through Chinese aggregators, which is the relay model running on somebody else’s hardware. Scraping .env files off misconfigured hosts has been background noise for a decade. What changed is the exit. A stolen key used to need a buyer, and now there’s a checkout page.

There’s a second-order cost too. Inference isn’t free for anyone, and the labs are already leaning on new revenue lines to close the gap, which is how OpenAI ended up running two ad slots per ChatGPT answer. Every dollar of abuse widens a hole that something else has to fill.

What this means for you

Rotate anything that has touched a public repo, a CI log, or a client bundle, and stop issuing organization-wide keys. Anthropic scopes each API key to one workspace and lets admins cap monthly spend per workspace, though its own docs note you can’t set limits on the Default Workspace, which is exactly where most keys are born. OpenAI’s project keys work on the same principle. Set the budget alert even when the cap is soft.

On the buying side, a provider quoting 90% off frontier pricing is running a relay, and your prompts travel through a middleman who can log every one of them. Hacker News asked the other obvious question: “How do you know the reseller is even giving you the genuine article? Could they be advertising Fable but repacking Deepseek?” Willison’s ask is the right one. “LLM vendors really need to get better at offering strict caps for their API keys,” he wrote, wanting apps that stop dead at a dollar threshold.

Lenhard’s own forecast is that pressure moves this rather than ends it. “As Anthropic and others roll out KYC controls and identity verification, the abuse won’t disappear, it will just move somewhere else.”