An Inside Look at the Relay Market Powering Token Resellers and Fraud

My Story

I’ve spent a lot of time thinking about token fraud, a problem I first stumbled upon while working as a software engineer on an AI gateway.

We faced constant abuse. At first it was free-credit abuse, where users spun up accounts en masse. Then it was our support chatbot. I started talking to friends about it and hearing stories of companies losing millions of dollars to abuse each day.

The abuse took a number of different shapes, and the abusers were relentless. I came to realize that the problem was much bigger than us. A new form of fraud had emerged, and it had become endemic to the token economy.

While researching where the abuse was coming from, I stumbled onto a Chinese forum where operators openly discussed the relays and their methods. My notes on the industry and its players are below.

So What Is a Relay?

A relay — or “transfer station” — is essentially a service that proxies traffic to U.S. models, often at a deep discount. For example, one operator’s price-comparison site listed a package that bought the equivalent of $3,333 worth of official Anthropic credit for 425 RMB — roughly $0.13 of usage per $1 spent.

To make that concrete, here’s how far below official pricing the relays we track actually run, ranked by discount:

• 01 Now Coding: 97.8%
• 02 I Code Easy: 97.1%
• 03 Claude ZZ: 96.6%
• 04 Doro: 96.4%
• 05 UoCode: 96.3%
• 06 ZeroCode: 94.9%
• 07 AiYa: 94.9%
• 08 HongMaCC: 94.2%
• 09 Right Code: 94.1%
• 10 BUZZ: 94.1%

How the Market Works

The ecosystem runs four layers deep, from the merchants sourcing raw accounts down to the developers buying cheap tokens:

• Upstream (卡商 / 号商): Card & account merchants — virtual credit cards built to pass U.S. and European billing checks, plus bulk-registered accounts.
• Midstream (账号池): Account pools — aggregate hundreds of upstream accounts, manage tokens and rate limits, handle failover, and expose a single API.
• Downstream (中转站): Relays / transfer stations — wrap the pool's API in a clean, billed, Chinese-language product and compete on price.
• End users: Developers, startups, and SaaS chasing cheap inference — plus commercial buyers running model distillation.

Upstream

Sitting at the top are the card merchants (卡商) and account merchants (号商). They sell virtual credit cards designed to pass U.S. and European billing checks, along with bulk-registered accounts.

Midstream

In the middle sit the account pools (账号池). A pool aggregates dozens or hundreds of upstream accounts, manages their authentication tokens and rate limits, handles failover when accounts get flagged, and exposes a single API surface that downstream relays can consume.

The inventory isn’t only model-lab accounts. Alongside direct OpenAI, Anthropic, and Google credentials are accounts harvested from the application layer. To a pool, it makes no difference whether a token comes from a lab or from an app built on one; anything that resells or exposes a model is a target.

Downstream

Downstream sit the relay / transfer stations themselves — the consumer-facing layer. They wrap the pool’s API in a clean Chinese-language product, handle billing and invoicing, run customer-support WeChat groups, and compete on price.

End users

At the bottom are individual Chinese developers, small startups, and mid-sized SaaS companies hunting for cheap inference — as well as some larger commercial buyers using the infrastructure for model distillation.

The Software Behind the Relays

Almost every relay I’ve looked at runs on one of two open-source projects: one-api or new-api.

Both are OpenAI-compatible gateways. An operator deploys the panel and adds a set of channels. Each channel represents a provider plus a pool of API keys. The panel exposes a single endpoint that matches the OpenAI API, so buyers just point their existing SDK at the relay’s URL. On every request it pulls a key from the pool, forwards it upstream, returns the response, and deducts quota priced by usage times a multiplier.

new-api is a more actively developed fork of one-api, and the difference is mostly commerce: it ships with self-service payment and recharge, plus image, video, and audio models. Across the relays we track, one-api turns up roughly four times as often as new-api.

The Methods

• Free-trial abuse: Abusers automate account creation en masse to claim free credits, then proxy that traffic back to their own end users.
• Chargeback attacks: Abusers charge back their spend after the usage period ends to recoup their costs — or use stolen cards from the start.
• Prepaid cards: Abusers fund accounts with prepaid cards capped at a set limit.
• Open inference: Any support chatbot without strict guardrails is ripe for having traffic proxied through it.
• Denial of wallet: Attackers fire off a flood of concurrent requests purely to burn a provider’s spend.

Who Are the Buyers?

The three main use cases seem to be cheap tokens, getting around geo-restrictions and model distillation. One forum participant noted: “Distillation uses Claude/CodeX models to train domestic models... many distillers in the industry have made millions.”

A Growing and Maturing Market

I was surprised by how mature the market already is. There are price-comparison sites for the relays, affiliate programs, and even gateway products. The ten highest-traffic relays we track pull a combined 3.6 million visits a month between them.

They’re Raffling Off Keys Now

A clear sign of how normalized this has become is that one of the relay directories runs a daily lottery for API keys. The site, hvoy.ai, gives away fifty $100 API keys every single day. The draw is provably fair — the same cryptographic scheme legitimate crypto-gambling sites use to prove they didn’t rig the result.

How Providers Can Defend Themselves

Fraud is a constant cat-and-mouse game. Here is a set of measures to mitigate abuse:

• Raise the cost of entry: Make accounts hard to create in bulk and cap what a fresh one can spend. Check for browser-based automation signals.
• Watch the money: Flag prepaid cards, virtual cards, mismatched billing info, and small card-testing charges.
• Watch the behavior: Look for patterns no real user produces: time from registration to first token, account age, and IP signals.
• Cluster the accounts: Watch for IP sybils and shared device fingerprints that tie supposedly-separate accounts back to one operator.
• Monitor for cost anomalies: Setup monitors and alerts on AI spend as a failsafe.

Assume some abuse gets through anyway, and limit what it can cost you:

• Enforce spend caps, spend locks, and concurrency limits per account.
• Reserve budget for every in-flight request.
• Start new accounts with low caps; let them earn higher limits with age and a verified card.
• If an account’s risk rises mid-session, add friction like a CAPTCHA or additional verification.

When you do catch someone, throttle quietly. A clean error just tells the attacker which signal to fix before they come back.