I’ve spent a lot of time thinking about token fraud, a problem I first stumbled upon while working as a software engineer on an AI gateway.
We faced constant abuse. At first it was free-credit abuse, where users spun up accounts en masse. Then it was our support chatbot. I started talking to friends about it and hearing stories of companies losing millions of dollars to abuse each day.
The abuse took a number of different shapes, and the abusers were relentless. I came to realize that the problem was much bigger than us. A new form of fraud had emerged, and it had become endemic to the token economy.
While researching where the abuse was coming from, I stumbled onto a Chinese forum where operators openly discussed the relays and their methods. My notes on the industry and its players are below.
A relay — or “transfer station” — is essentially a service that proxies traffic to U.S. models, often at a deep discount. For example, one operator’s price-comparison site listed a package that bought the equivalent of $3,333 worth of official Anthropic credit for 425 RMB — roughly $0.13 of usage per $1 spent.
To make that concrete, here’s how far below official pricing the relays we track actually run, ranked by discount:
The ecosystem runs four layers deep, from the merchants sourcing raw accounts down to the developers buying cheap tokens:
Card & account merchants — virtual credit cards built to pass U.S. and European billing checks, plus bulk-registered accounts.
Account pools — aggregate hundreds of upstream accounts, manage tokens and rate limits, handle failover, and expose a single API.
Relays / transfer stations — wrap the pool's API in a clean, billed, Chinese-language product and compete on price.
Developers, startups, and SaaS chasing cheap inference — plus commercial buyers running model distillation.
Sitting at the top are the card merchants (卡商) and account merchants (号商). They sell virtual credit cards designed to pass U.S. and European billing checks, along with bulk-registered accounts.
In the middle sit the account pools (账号池) . A pool aggregates dozens or hundreds of upstream accounts, manages their authentication tokens and rate limits, handles failover when accounts get flagged, and exposes a single API surface that downstream relays can consume.
The inventory isn’t only model-lab accounts. Alongside direct OpenAI, Anthropic, and Google credentials are accounts harvested from the application layer.
Much of the forum’s activity centers on “reverse-engineered” access to tools like Kiro and antigravity, which are consumer products, not lab APIs. To a pool, it makes no difference whether a token comes from a lab or from an app built on one; anything that resells or exposes a model is a target.
Downstream sit the relay / transfer stations themselves — the consumer-facing layer. They wrap the pool’s API in a clean Chinese-language product, handle billing and invoicing, run customer-support WeChat groups, and compete on price.
At the bottom are individual Chinese developers, small startups, and mid-sized SaaS companies hunting for cheap inference — as well as some larger commercial buyers using the infrastructure for model distillation.
In practice these layers blur. Many operators run both the pool and the relay, and the forum’s own participants often use “pool” and “transfer station” interchangeably.
Almost every relay I’ve looked at runs on one of two open-source projects: one-api or new-api .
Both are OpenAI-compatible gateways. An operator deploys the panel and adds a set of channels (渠道) . Each channel represents a provider plus a pool of API keys. The panel exposes a single endpoint that matches the OpenAI API, so buyers just point their existing SDK at the relay’s URL. On every request it pulls a key from the pool, forwards it upstream, returns the response, and deducts quota priced by usage times a multiplier (倍率) . It manages the users, tokens, pricing tiers, logs, and billing.
new-api is a more actively developed fork of one-api , and the difference is mostly commerce: it ships with self-service payment and recharge, plus image, video, and audio models. Across the relays we track, one-api turns up roughly four times as often as new-api; the original base is the more widespread of the two, even if new-api is the one built to sell.
There’s nothing inherently illicit about the software. one-api and new-api are neutral, legitimate tools. Plenty of companies self-host them to put their own accounts behind a single gateway with team quotas and spend tracking. A relay crosses the line when its channels are stocked with stolen, leaked, or pooled keys instead of the operator’s own, and when it resells that access against the providers’ terms.
The three main use cases seem to be cheap tokens, getting around geo-restrictions and model distillation. A few relevant quotes from the forum:
“Distillation uses Claude/CodeX models to train domestic models. There are intermediaries that specialize in distillation and can provide relevant evidence, but I can’t name specific domestic companies. Anyway, companies with strong programming capabilities are all distilling Claude; it’s a multi-billion RMB industry chain, and many big players earn hundreds of thousands a day.”
“It’s not just true — many distillers in the industry have made millions.”
“I got 20TB on my first day online.” (And: “You might get 100TB of traffic as soon as you go online.”)
I was surprised by how mature the market already is. There are price-comparison sites for the relays, affiliate programs, and even gateway products. On the forums, consumer demand looks just as strong. And these aren’t fringe operations: the ten highest-traffic relays we track pull a combined 3.6 million visits a month between them.
My hunch is that things get worse for the application layer from here. As Anthropic and others roll out KYC controls and identity verification, the abuse won’t disappear, it will just move somewhere else.
A clear sign of how normalized this has become is that one of the relay directories runs a daily lottery for API keys.
The site — hvoy.ai, which otherwise bills itself as a relay authenticity checker and price-comparison tool, gives away fifty $100 API keys every single day. You earn entry credits from a daily check-in, spend 20 credits per ticket, and can buy up to three tickets a round. On the day I looked, 258 people had entered 401 tickets for the fifty keys.
The part that got me is the fairness theater. The draw is provably fair — the same cryptographic scheme legitimate crypto-gambling sites use to prove they didn’t rig the result. The random seed is the hash of the latest Bitcoin block, winners are picked with a Partial Fisher-Yates shuffle, and the full list of entries is published as a snapshot before the draw.
I’ve talked to many companies facing this, and the truth is that there’s no clean fix. Fraud is a constant cat-and-mouse game. What follows isn’t a silver bullet — it’s the set of things that I’ve seen work and that others are doing, roughly in the order that abuse travels: from account creation, to detection and then to damage control.
Assume some abuse gets through anyway, and limit what it can cost you:
And when you do catch someone, throttle quietly. A clean error just tells the attacker which signal to fix before they come back.
None of this stops the abuse for good. But if you make attacking your own service expensive enough that the numbers stop working, they’ll try to find an easier target.
All quotes are translated from a V2EX thread in the site’s Programmers section, “A comprehensive guide to AI transfer station jargon,” started by the user v2exgo (who operates the relay at terminal.pub). The thread ran from March 5 to June 23, 2026 and drew roughly 35,000 views and 190 replies. Reply numbers below refer to that thread.
扫码直达文章详情