Yunwu.ai was a nice way to get ultra-cheap tokens that someone will probably spy on you with, but they no longer offer US models.
At first I thought it was so people could steal the traces, but now I wonder if this isn't just laundering startup credits for dollars.
npn•Aug 16, 2026
There are like thousands sites with similar features all using newapi core.
You can easily find them in Chinese tech forum linux.do
SatishPophale•Aug 16, 2026
yep, with projects like open api/newapi it takes maybe 10 min to pin up and openAi compatible poxy gateway. The cheap prices look tempting until the relay operator logs all your prompts or the upstream account gets banned mid-request.
theli0nheart•Aug 16, 2026
They were never offering actual US models. We tested them extensively and it was clear whatever they were passing as Anthropic were simply mediocre distillations based on Kimi.
arjie•Aug 16, 2026
Haha! Incredible. What a scam! Too good to be true, I suppose. I never used it for anything meaningful because everything meaningful is also tragically sensitive so I suppose I didn't notice.
topbanana•Aug 16, 2026
So are they stealing from their employers or is something else going on?
huflungdung•Aug 16, 2026
Stolen credit cards
Demo accounts
Free trials
Unlimited chat relays (eg chatgpt chat)
Leaked company credentials
Etc
notpushkin•Aug 16, 2026
And I’m pretty sure that’s just the tip of the iceberg.
dzonga•Aug 16, 2026
nope - a.i companies to promote their platforms offer 'a.i' credits to startups usually worth 10ks, 100ks worth of credits in $ terms.
so to a startup - you can trade your credits - then get actual cash.
just like you would if trading debt etc.
rfgplk•Aug 16, 2026
What is the logic behind selling at such a steep discount? Lack of buyers or trust? Seems insane to sell tham at -50% or more, especially since you can use them yourself (if you're a startup)
manquer•Aug 16, 2026
Risk-reward calculus. A buyer may not take the risk or hassle of going underground only for a small upside. Basically it is not as tempting at 90% of list price, but it is at 10% .
TZubiri•Aug 16, 2026
Men breaching Sauron's ToS by reselling their nine rings of power, and they think they are beating the system.
bix6•Aug 16, 2026
> CREDITS FROM YC STARTUP SCHOOL
Join YC, get free shit from the network, profit. Nice.
notpushkin•Aug 16, 2026
> CREDITS FROM YC STARTUP SCHOOL
Is that still a thing? I’ve thought they’ve discontinued the deals section. (There are a lot of other ways to get a startup grant, of course.)
pocksuppet•Aug 16, 2026
What will you pitch to YC to get accepted?
andy99•Aug 16, 2026
As a bonus, you’ve got a story for the “tell me about a time you hacked a non computer system” question on the YC application
ValentineC•Aug 16, 2026
Reselling something one gets for free doesn't sound like a very clever hack.
People trading their unused credits feels more genuine, although still in violation of the agreements. The person who got into YC Startup School who was trying to resell the $2500 of credits was interesting. It wouldn’t be that hard for OpenAI to identify the IP addresses of the relays and start flagging accounts, tracing it back to the source. Risking burning your bridges with YC for a relatively small profit is a questionable decision.
The original article showed discounts ranging all the way up to 98%. At those levels it’s obviously not people reselling anything. It’s either sourced from stolen API keys, bought with stolen credit cards, or acquired through automated sign up of trial accounts if you’re actually getting the API you request.
I would expect a lot of them are reselling a different API. Sign up for Anthropic tokens and get Deepseek responses instead.
judge2020•Aug 16, 2026
Another part of the discount is that Claude Max 20x is $200 but gives usage equivalent to thousands of dollars worth of API-based token spend.
But also, resellers only need to make an overall profit including kickbacks from the companies purchasing token history for distillation.
ffsm8•Aug 16, 2026
It's also unclear wherever the subscription price is the real cost, or the API.
I suspect it's closer to the sub price and anthropic is just milking their API users, but that's something you'd only know from the inside
HeatrayEnjoyer•Aug 16, 2026
Open weight SOTA models are not greatly cheaper than Anthropic and providers don't have to cover training capex.
bonoboTP•Aug 16, 2026
Costs also have to include the amortized training costs.
But the API price is likely simply regular supply and demand, charging as much as the market will pay. Corporations are dropping insane amounts because it's still peanuts for many industries. Software has just been ridiculously cheap before AI. So high prices are still low for companies if it eases some bottlenecks.
HWR_14•Aug 16, 2026
The costs only have to include amortized training costs if you are trying to be profitable overall. Having positive unit economics and VC subsidized fixed costs is pretty standard.
Geezus_42•Aug 16, 2026
What happens when the VCs decide to stop dumping more money onto the fire?
HWR_14•Aug 16, 2026
Positive unit economics means that inference as a business continues regardless. The VC's no longer dumping money in means no more training new models.
bonoboTP•Aug 16, 2026
Not if there is competition who does train newer and better models.
jfaat•Aug 17, 2026
By lighting VC (public soon) money on fire...
drawnwren•Aug 16, 2026
Generally speaking, B2B prices are rarely supply-and-demand priced in the usual sense.
YC has advised startups in the past that it's easier to sell a single $100k customer than 100 $1k customers.
It would also be relatively surprising to learn that i.e. the Chinese providers are OOMs better at inference than OAI/Anthropic (like their prices would imply if they were in a perfectly competitive market).
bonoboTP•Aug 16, 2026
Chinese prices aren't really OOM cheaper. Deepseek recently did a big price hike too.
drawnwren•Aug 16, 2026
Fair, I hadn't looked recently. It looks like currently kimi is either 1/2 or 1/4 Ant pricing depending on whether you think Opus 5 is usable or not. (Deepseek is still an OOM though)
ronsor•Aug 16, 2026
The one thing I trust is that Chinese prices aren't overinflated. They're almost certainly closer to the actual cost of inference + training amortization than what Western labs are offering.
DeepSeek's price hike is mostly driven by increased demand, for example. It's not about losses so much as they don't have enough infrastructure and need to reduce demand somehow.
bonoboTP•Aug 16, 2026
Why do you have this trust? Are they not profit oriented? Or you suspect that Xi's policy push is to undercut American AI?
pyvpx•Aug 16, 2026
Are you familiar with Chinas version of capitalism? It is markedly different than “the” western model
dragonwriter•Aug 16, 2026
“It's also unclear wherever the subscription price is the real cost, or the API.”
There is no “real cost” other than the cost actually charged.
doctorpangloss•Aug 17, 2026
> Another part of the discount is that Claude Max 20x is $200 but gives usage equivalent to thousands of dollars worth of API-based token spend.
this is all it is. it's not complicated.
diego_sandoval•Aug 17, 2026
Except for the cases of credit card fraud, I don't see what's morally wrong with it, for it to be called "fraud".
It's just reselling.
Maybe people are starting to copy Anthropic's rhetoric of "everything that inconveniences me is fraud (e.g. distillation). Everything that benefits me is legit."
joshuacc•Aug 17, 2026
Lying to someone to deceive them into providing you with an economic benefit that they otherwise wouldn’t is textbook fraud.
fg137•Aug 16, 2026
These are amateurs compared to what's happening in China.
herpdyderp•Aug 16, 2026
Explain please?
tclancy•Aug 16, 2026
They built this wall …
ander33•Aug 16, 2026
This would be a fantastic method of getting data for distillation, would be surprised if that's not why the tokens are so cheap
tclancy•Aug 16, 2026
Hey Claude, scan these marketplaces for arbitrage opportunities.
The thing will eat itself unless the AI companies find a way to make money directly from it.
peter_d_sherman•Aug 16, 2026
So let's see, we have the following factors in play:
1) Capitalism - Adam Smith, John Maynard Keynes (Keynesian Economics), etc., etc. in most places in the world...
2) Huge validated existing international market...
3) Multi-jurisdictional World... laws/statutory codes applicable to businesses in specific circumstances in one place may not be applicable to businesses in specific circumstances in another...
4) AI Tokens are a commodity; i.e., there is no chokepoint or monopoly controlled by one AI company in one jurisdiction, i.e., if one AI company makes rules unacceptable to a token consumer, that consumer can simply switch providers to another provider in another jurisdiction somewhere else in the world.
5) Tokens can be bought, sold, and resold at profit just like any other good or service.
6) Tokens can be bought from anywhere in the world and sold to anywhere in the world. Easily.
7) Tokens are a digital good, easy to scale, and do not require supply chains, lead times, labor, manufacturing, warehousing, shipping, going through geographic chokepoints, customs, etc., etc. -- all of the things that manufactured goods do.
8) Many people around the world want to make money or make more money... i.e., "economic incentive" (aka Capitalism's "profit motive")...
Well... add all of those together and what do you get?
You get buy/sell/trade forums/auctions/individuals/brokers/businesspeople -- around that market...
Just like you get those same things around every other market.
In this large multi-jurisdictional world, if one government makes all of that illegal in their country, then another government is going to be happily collecting all of the taxes from making all of that legal, in theirs!
If a given government makes trade illegal -- then they correspondingly lose the tax revenue...
Taxes and trade are intricately, intricately intertwined...
Could this business model be used for money laundering or other illegal activities?
Yes -- but any other business model could as well!
And, on the flip side, this business model could be accomplished legally/lawfully/morally/ethically -- just like any other business where there is an actual underlying value being exchanged.
Because, AI Tokens, if legally/lawfully/morally/ethically traded, do have underlying value...
In conclusion, at this point in time, I am neither for this business model nor against it...
But I think it'll be highly interesting to watch this space for the next couple of years, to see what happens, to see who does what, to see what plays out on the legal front, on the government front (foreign + domestic), on the media front, and on the technology front surrounding it...
nerevarthelame•Aug 16, 2026
Distillation is one of the most unique and interesting aspects of this.
But otherwise, if a company gives something valuable for creating an account on their platform, expect that people will automate the creation of millions of accounts. If employees of B2B partners get benefits, they will resell them. Accounts will be hacked and resold. The same basic abuse patterns are decades old for online delivery services, loyalty accounts for airline and hotels, etc. There are entire industries dedicated to those spaces as well: large organizations with physical offices, hundreds of employees, HR departments, etc. dedicated to reselling digital benefits on grey markets.
Some companies are tolerant of allowing this to happen. The pessimistic view is that even illegitimate traffic contributes to the KPIs that your investors care about. The slightly less pessimistic view is that fraud prevention will always have trade-offs and false positives, and sometimes the savings of preventing fraud are genuinely outweighed by the false positives. Or maybe it's just Hanlon's razor and they truly never saw it coming.
tantalor•Aug 16, 2026
> I checked where you’d expect to find underground marketplaces. Telegram had a few channels, with one being relatively active.
It's not exactly "underground" if they clearly advertising public channels out in the open.
veganmosfet•Aug 16, 2026
The reseller could use an intermediate proxy and modify the traffic like in [1], to get control of the client machine - depending on the harness permissions.
TLS terminates at the proxy (say, https://reselltokens.ai), end to end integrity is not enforced. LLM traffic contains tool calls like "bash ...", which are executed on the client machine, they can be manipulated. Secret exfil is also possible.
I swear every time I think I have a unique tweak for an OSS tool, it turns out someone else did it. I forked CLIProxyAPI myself to add something similar, though my implementation is closer to a provider-egress DLP layer and it's intended for API keys and the like, not PII. It uses gitleaks but also supports reversible redaction so a secret that's flagged can be replaced with a placeholder before CLIProxyAPI sends the request to the provider and then any instances of that placeholder can be rehydrated in the response to the caller.
Since it modifies logic across the full request/response lifecycle, I unfortunately couldn't implement it cleanly with the existing plugin API.
andai•Aug 16, 2026
Nice, he can help fix my Linux Bluetooth audio issues.
tantalor•Aug 16, 2026
There's a lot of assertion here and the other article that this fraud and abuse but is there any evidence of that?
A simpler explanation is that that this is just a resale market.
mlenhard•Aug 16, 2026
From talking with some of the companies experiencing this, I can confirm that a portion of it is actual credit card fraud. Tokens have become a pseudo-currency, making them a prime target for abuse.
Some of the abuse is more benign, but there is also real fraud through chargebacks, account takeovers, and stolen credit cards.
dataflow•Aug 16, 2026
When you say a portion is that more like 1%, 5%, 20%, 50%, or 90%?
mlenhard•Aug 16, 2026
I don't have exact numbers here, and it varies by company, but a rough guess is around 10-20%. This might be a bit biased because the companies willing to talk to me are probably seeing the worst of it.
Also, outside the labs, most of the companies I've talked with have shut off free tiers and free credits entirely because the abuse is so bad.
thunderfork•Aug 16, 2026
Any situation where you can extract a benefit from a stolen credit card and then sell that benefit before the chargeback renders it moot will have some fraud-based usage.
baobabKoodaa•Aug 16, 2026
Cyberpunk dystopia vibes
bwfan123•Aug 16, 2026
> Cyberpunk dystopia vibes
right. Abstractions taken to the max. When tech solves problems that only 0.001% care about. NFT smelt similar.
andy99•Aug 16, 2026
What does the demand side look like? I understand why people have these tokens they want to sell, who wants to buy them?
namelosw•Aug 16, 2026
Chinese. There are large number of Chinese people who are dependent on the Western model because they're still ahead of the game. But they're continuously getting banned and getting super frustrated.
Especially for Claude because Anthropic is very good at identifying mainland Chinese and getting them banned in hours. There are many of them who are willing to pay more than the original rate for a stable experience.
It's very hard for them because they'll need a legit phone number and bank cards that are not issued in China, and a clean enough IP, etc. and those better match together to make sense. (Back in the day, ChatGPT required resident IPs, which made it worse, but they worry about growth more now). Obviously, they have to use a VPN to access the real Internet, and most of the IPs they can find are shared with bots and abusers.
dataflow•Aug 16, 2026
What does it mean for a phone number, bank card, and IP to "match together to make sense"?
namelosw•Aug 17, 2026
Like using a British SIM card like Giffgaff, a Singaporean bank card, and an American IP, speaking simplified Chinese, working in the Chinese timezone, which is often the obvious combination of Chinese users. Or using a Nigerian/Turkish App Store/Play Store, also very common.
These combinations are questionable and very easy to filter, probably with Luna/Haiku tier of models that are able to tell things might get fishy here, and it would likely escalate to heavier checks and trigger KYC or straight banning.
Those are only my guess and probably aren't how the system works, but I think these rules are fairly easy to come up with for developers who have any idea of anti-abuse. I've seen too many Chinese posts mourning their accounts and communicating that their setups there would be similar mechanisms, I would say.
In previous months, there was news that Claude Code uploading a special signal for the Chinese timezone is pretty evident. I probably got away from having serious insomnia, using PST on my computers, and exclusively speaking English with those models lol.
Sha1rholder•Aug 16, 2026
This research is way toooo shallow. He really should go check out linux.do or nodeseek.com — token resale economy there is truly breathtaking.
This was specifically meant to be about the ai credit resellers, not the relays themselves. I put together another piece here: https://vectoral.com/blog/token-relay-market that tackles that side of the market.
vb-8448•Aug 16, 2026
Wait a sec, I have to trust a third party with basically no reputation, did I get it right?
It's basically asking for being hacked and/or sending you private data to random email addresses! Neither at a 99% discount I'd do it.
I understand if someone, for any reason, cannot access a specific model ... But nowadays, there are so many alternatives that even this doesn't make sense any more.
Aurornis•Aug 16, 2026
I expect most of the use to be for bulk data processing or desperate founders who don't care, not for agentic coding use at promising startups.
If your startup needs to run a million records of something, especially public data, through an LLM to extract the data you need, using bootleg tokens to shrink the bill starts feeling tempting.
If you're concerned about the data leaking, the biggest risk is that the API backends are quietly routing your requests to a cheaper model. You might be trying to buy Opus tokens but get Deepseek Flash responses.
vb-8448•Aug 16, 2026
> to run a million records of something, especially public data, through an LLM to extract the data you need
Maybe this make sense, but anyway I have to pay a lot of attention at the output I get. Eg: who guarantees there is no prompt/sql injection? Especially if I have to load the output in some internal system.
Aurornis•Aug 16, 2026
Bulk data processing typically has structured JSON output.
I mean someone could try to sneak prompt injection into a text field, but the people buying black market resale tokens from third parties aren’t thinking about anything other than getting cheap output.
charlieyu1•Aug 16, 2026
I mean reselling items bought with stolen credit cards have been a thing for at least 20 years
vb-8448•Aug 16, 2026
I don't risk being hacked if I buy some stuff on vinted.
miroljub•Aug 16, 2026
I'd rather trust a third party with no reputation than a well known Misanthropic company led by a man whose wife was asking Epstein for investment. They are even less trustworthy then ClosedAI.
raincole•Aug 16, 2026
It's really common in China where OpenAI and Anthropic models are firewalled. There was a joke that Chinese people didn't realize how cheap DeepSeek was, because they already were using resold ChatGPT/Opus tokens at that price.
Here is a more detailed article about how it works:
Oh that's interesting, looks like those proxies are probably also selling the data to Chinese AI companies for training.
segmondy•Aug 16, 2026
So what? The world is more trustworthy than you can imagine. I have bought over 30 GPUs over the internet, sight unseen. From around the world and every single one has arrived good. I have also gotten over 20 from marketplace and the same. Use your common sense, from conversation and everything else, you can often separate the scammers from real folks.
vb-8448•Aug 16, 2026
It's not like buying random stuff that you can inspect!
You have no way to verify that your data is not sold to someone else, send to the provider you think, or the response is genuine and not full of prompt injections or other stuff!
voidmain0001•Aug 16, 2026
The article indicates that the provided API key is probably a proxy to the actual so the third party is also recording all prompts made using the proxy key.
RALaBarge•Aug 16, 2026
Most of these are your standard botnet rings. Either accounts directly are taken over, and the attacker adds 2FA or carding rings take stolen #s and attempt to add credits.
It is...incredible how many there are. Stripe does far too little in my opinion to help prevent issues like this, even though they have the business intelligence and enough data to do so.
ronsor•Aug 16, 2026
I think Stripe does enough already. Fraud detection is a crapshoot regardless; I've had legitimate transactions rejected at random without explanation.
reticulates•Aug 16, 2026
A common refrain is that oh there are such great margins on tokens that none of this matters… I wonder how long until that notion will be disavowed? The scale of the tokensnaffling is massive, not just from resale, but also people using multiple subscriptions. The amount of subsidization is only growing, every week it seems like OpenAI and Anthropic are doing “resets” which allow a single $200 subscription to incur $20k+ of usage (if billed at API rates). At some point we must all surely accept that the economics of this do not work.
ralph84•Aug 16, 2026
Or API rates are their way of doing price discrimination and it's all profitable. Make sure Enterprises(tm) pay the Enterprise(tm) rate, but mop up the rest of the demand too at lower price points. This has been part of the software playbook for decades.
xyst•Aug 16, 2026
When "token futures contracts", start selling. Then the bubble is about to burst.
"My rough estimate is that, across the sites, forums, and resellers I looked at, there are probably tens of millions of these credits being offered." Yeah very useful statemenet it's not like everyone spends hundreds of millions of tokens per day on the 100 or 200$ plan
mlenhard•Aug 16, 2026
This was poorly worded on my part; I meant in terms of dollars, not tokens.
zuzululu•Aug 16, 2026
man seems like this entire thread invited a bunch of ads for exactly the thing talked about in the article
can't they detect if someone is reselling their tokens like this ? doesn't seem too hard
jeffchuber•Aug 16, 2026
that one platform is using a flipped chroma logo - chroma has nothing to do with this racket (source : i’m chroma’s ceo)
dmaa•Aug 16, 2026
How can you verify, that the model that you are buying is the one that you are actually getting?
chrysoprace•Aug 16, 2026
You basically can't. This episode from Syntax[0] shows one provider that he tried to go through to showcase this, and he was fairly certain it wasn't Claude, but of course that was all speculation on his part.
27 Comments
https://news.ycombinator.com/item?id=48664223
At first I thought it was so people could steal the traces, but now I wonder if this isn't just laundering startup credits for dollars.
You can easily find them in Chinese tech forum linux.do
Demo accounts
Free trials
Unlimited chat relays (eg chatgpt chat)
Leaked company credentials
Etc
so to a startup - you can trade your credits - then get actual cash.
just like you would if trading debt etc.
Join YC, get free shit from the network, profit. Nice.
Is that still a thing? I’ve thought they’ve discontinued the deals section. (There are a lot of other ways to get a startup grant, of course.)
People trading their unused credits feels more genuine, although still in violation of the agreements. The person who got into YC Startup School who was trying to resell the $2500 of credits was interesting. It wouldn’t be that hard for OpenAI to identify the IP addresses of the relays and start flagging accounts, tracing it back to the source. Risking burning your bridges with YC for a relatively small profit is a questionable decision.
The original article showed discounts ranging all the way up to 98%. At those levels it’s obviously not people reselling anything. It’s either sourced from stolen API keys, bought with stolen credit cards, or acquired through automated sign up of trial accounts if you’re actually getting the API you request.
I would expect a lot of them are reselling a different API. Sign up for Anthropic tokens and get Deepseek responses instead.
But also, resellers only need to make an overall profit including kickbacks from the companies purchasing token history for distillation.
I suspect it's closer to the sub price and anthropic is just milking their API users, but that's something you'd only know from the inside
But the API price is likely simply regular supply and demand, charging as much as the market will pay. Corporations are dropping insane amounts because it's still peanuts for many industries. Software has just been ridiculously cheap before AI. So high prices are still low for companies if it eases some bottlenecks.
YC has advised startups in the past that it's easier to sell a single $100k customer than 100 $1k customers.
It would also be relatively surprising to learn that i.e. the Chinese providers are OOMs better at inference than OAI/Anthropic (like their prices would imply if they were in a perfectly competitive market).
DeepSeek's price hike is mostly driven by increased demand, for example. It's not about losses so much as they don't have enough infrastructure and need to reduce demand somehow.
There is no “real cost” other than the cost actually charged.
this is all it is. it's not complicated.
It's just reselling.
Maybe people are starting to copy Anthropic's rhetoric of "everything that inconveniences me is fraud (e.g. distillation). Everything that benefits me is legit."
The thing will eat itself unless the AI companies find a way to make money directly from it.
1) Capitalism - Adam Smith, John Maynard Keynes (Keynesian Economics), etc., etc. in most places in the world...
2) Huge validated existing international market...
3) Multi-jurisdictional World... laws/statutory codes applicable to businesses in specific circumstances in one place may not be applicable to businesses in specific circumstances in another...
4) AI Tokens are a commodity; i.e., there is no chokepoint or monopoly controlled by one AI company in one jurisdiction, i.e., if one AI company makes rules unacceptable to a token consumer, that consumer can simply switch providers to another provider in another jurisdiction somewhere else in the world.
5) Tokens can be bought, sold, and resold at profit just like any other good or service.
6) Tokens can be bought from anywhere in the world and sold to anywhere in the world. Easily.
7) Tokens are a digital good, easy to scale, and do not require supply chains, lead times, labor, manufacturing, warehousing, shipping, going through geographic chokepoints, customs, etc., etc. -- all of the things that manufactured goods do.
8) Many people around the world want to make money or make more money... i.e., "economic incentive" (aka Capitalism's "profit motive")...
Well... add all of those together and what do you get?
You get buy/sell/trade forums/auctions/individuals/brokers/businesspeople -- around that market...
Just like you get those same things around every other market.
In this large multi-jurisdictional world, if one government makes all of that illegal in their country, then another government is going to be happily collecting all of the taxes from making all of that legal, in theirs!
If a given government makes trade illegal -- then they correspondingly lose the tax revenue...
Taxes and trade are intricately, intricately intertwined...
Could this business model be used for money laundering or other illegal activities?
Yes -- but any other business model could as well!
And, on the flip side, this business model could be accomplished legally/lawfully/morally/ethically -- just like any other business where there is an actual underlying value being exchanged.
Because, AI Tokens, if legally/lawfully/morally/ethically traded, do have underlying value...
In conclusion, at this point in time, I am neither for this business model nor against it...
But I think it'll be highly interesting to watch this space for the next couple of years, to see what happens, to see who does what, to see what plays out on the legal front, on the government front (foreign + domestic), on the media front, and on the technology front surrounding it...
But otherwise, if a company gives something valuable for creating an account on their platform, expect that people will automate the creation of millions of accounts. If employees of B2B partners get benefits, they will resell them. Accounts will be hacked and resold. The same basic abuse patterns are decades old for online delivery services, loyalty accounts for airline and hotels, etc. There are entire industries dedicated to those spaces as well: large organizations with physical offices, hundreds of employees, HR departments, etc. dedicated to reselling digital benefits on grey markets.
Some companies are tolerant of allowing this to happen. The pessimistic view is that even illegitimate traffic contributes to the KPIs that your investors care about. The slightly less pessimistic view is that fraud prevention will always have trade-offs and false positives, and sometimes the savings of preventing fraud are genuinely outweighed by the false positives. Or maybe it's just Hanlon's razor and they truly never saw it coming.
It's not exactly "underground" if they clearly advertising public channels out in the open.
TLS terminates at the proxy (say, https://reselltokens.ai), end to end integrity is not enforced. LLM traffic contains tool calls like "bash ...", which are executed on the client machine, they can be manipulated. Secret exfil is also possible.
[1] https://arxiv.org/html/2604.08407v1
There are community plugins like this: https://github.com/rheodev/cpa-plugin-privacyfilter
I haven't tried the plugin system myself yet.
Since it modifies logic across the full request/response lifecycle, I unfortunately couldn't implement it cleanly with the existing plugin API.
A simpler explanation is that that this is just a resale market.
Some of the abuse is more benign, but there is also real fraud through chargebacks, account takeovers, and stolen credit cards.
Also, outside the labs, most of the companies I've talked with have shut off free tiers and free credits entirely because the abuse is so bad.
right. Abstractions taken to the max. When tech solves problems that only 0.001% care about. NFT smelt similar.
Especially for Claude because Anthropic is very good at identifying mainland Chinese and getting them banned in hours. There are many of them who are willing to pay more than the original rate for a stable experience.
It's very hard for them because they'll need a legit phone number and bank cards that are not issued in China, and a clean enough IP, etc. and those better match together to make sense. (Back in the day, ChatGPT required resident IPs, which made it worse, but they worry about growth more now). Obviously, they have to use a VPN to access the real Internet, and most of the IPs they can find are shared with bots and abusers.
These combinations are questionable and very easy to filter, probably with Luna/Haiku tier of models that are able to tell things might get fishy here, and it would likely escalate to heavier checks and trigger KYC or straight banning.
Those are only my guess and probably aren't how the system works, but I think these rules are fairly easy to come up with for developers who have any idea of anti-abuse. I've seen too many Chinese posts mourning their accounts and communicating that their setups there would be similar mechanisms, I would say.
In previous months, there was news that Claude Code uploading a special signal for the Chinese timezone is pretty evident. I probably got away from having serious insomnia, using PST on my computers, and exclusively speaking English with those models lol.
Edit: https://vectoral.com/blog/token-relay-market mentioned in comment.
It's basically asking for being hacked and/or sending you private data to random email addresses! Neither at a 99% discount I'd do it.
I understand if someone, for any reason, cannot access a specific model ... But nowadays, there are so many alternatives that even this doesn't make sense any more.
If your startup needs to run a million records of something, especially public data, through an LLM to extract the data you need, using bootleg tokens to shrink the bill starts feeling tempting.
If you're concerned about the data leaking, the biggest risk is that the API backends are quietly routing your requests to a cheaper model. You might be trying to buy Opus tokens but get Deepseek Flash responses.
Maybe this make sense, but anyway I have to pay a lot of attention at the output I get. Eg: who guarantees there is no prompt/sql injection? Especially if I have to load the output in some internal system.
I mean someone could try to sneak prompt injection into a text field, but the people buying black market resale tokens from third parties aren’t thinking about anything other than getting cheap output.
Here is a more detailed article about how it works:
https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens...
You have no way to verify that your data is not sold to someone else, send to the provider you think, or the response is genuine and not full of prompt injections or other stuff!
It is...incredible how many there are. Stripe does far too little in my opinion to help prevent issues like this, even though they have the business intelligence and enough data to do so.
can't they detect if someone is reselling their tokens like this ? doesn't seem too hard
[0] https://www.youtube.com/watch?v=09UELaUhPEw