Update for June’s black-market story: Matt Lenhard’s Vectoral report (June 28, 2026; resurfaced hard on HN ~July 27) names the industrial plumbing behind discounted Claude/Codex access — not just “someone sells cheap tokens,” but a four-layer relay stack with Mandarin jargon, open-source gateways, price-comparison sites, and even a provably fair lottery for $100 API keys.
If you only need the consumer HN snapshot from Greg Kamradt week, stay on AI token black market. This post is the relay anatomy decode — supply chain, software, methods, buyers, defenses, and the July HN fight over whether this is fraud, arbitrage, or both.
TL;DR — What People Are Asking
| Question | Answer |
|---|---|
| Primary source? | Matt Lenhard / Vectoral · Jun 28, 2026 |
| Forum? | V2EX “transfer station jargon” thread (~35k views) |
| Stack? | 卡商 → 账号池 → 中转站 → buyers |
| Soft panels? | one-api / new-api (OpenAI-compatible) |
| Discount ballpark? | Often ~94–98% off list (tracked medians) |
| Traffic? | Top 10 relays ~3.6M visits/month (Lenhard) |
| Buyers? | Cheap tokens · geo bypass · distillation |
| Lab response? | KYC / caps — abuse moves, doesn’t vanish |
| Builder rule? | Ultra-cheap OpenAI-compatible URLs = trust hazard |
| Layer | Mandarin | Job |
|---|---|---|
| Upstream | 卡商 / 号商 | Cards + bulk accounts |
| Midstream | 账号池 | Pool keys, limits, failover |
| Downstream | 中转站 | Billed Chinese product |
| End | — | Devs, SaaS, distillers |
What a Relay Actually Is
A relay / transfer station proxies traffic to U.S. models at a deep discount. Lenhard’s concrete example: a price-comparison listing that equated a package to $3,333 of official Anthropic credit for 425 RMB — framed as roughly $0.13 of official usage per $1 spent at the steep end. HN immediately argued about the wording and zeros (some readers reverse it as “$1 of usage for ~$0.13”); Lenhard acknowledged cleanup. What matters for operators: discounts deep enough that honest API list price is not the competing offer.
His tracked leaderboard put median discounts in the mid-90%s for names like Now Coding, I Code Easy, Claude ZZ, Doro, UoCode — with a longer list of ~49 relays. Treat brand names as observed marketplace actors, not endorsements.
Four Layers Deep
1. Upstream — card & account merchants
Virtual cards tuned to pass U.S./EU billing checks; bulk-registered accounts.
2. Midstream — account pools
Aggregate dozens to hundreds of accounts, rotate auth tokens, manage rate limits, failover when keys burn, expose one API. Inventory is not only lab keys — forums obsess over reverse-engineered access to consumer apps (Lenhard cites tools like Kiro and antigravity). To a pool, a token is a token.
3. Downstream — relays
Wrap the pool in Chinese UX, invoicing, WeChat support, affiliate programs. Compete on price.
4. End users
Individual developers, startups, mid-size SaaS chasing cheap inference — and commercial buyers running model distillation.
Layers blur: many operators run pool + relay; forum slang uses “pool” and “transfer station” interchangeably.
The Software (Neutral Tools, Contaminated Inventory)
Almost every relay Lenhard inspected runs one-api or new-api — OpenAI-compatible gateways. Operator deploys a panel, adds channels (provider + key pool), exposes one /v1-style endpoint, multiplies usage by a pricing factor (倍率), and deducts quota. Buyers point existing SDKs at the relay URL.
new-api forks commerce features (self-serve recharge, multimodal). Across his sample, one-api showed up ~4× more often.
Critical distinction Lenhard draws — and explainx.ai repeats: the software is not the crime. Teams self-host these panels for legitimate multi-key routing. The line is crossed when channels are stocked with stolen, leaked, trial-farmed, or ToS-violating pooled keys and resold.
Simon Willison flagged both repos on the HN thread; builders should assume any random “cheap Claude base URL” is one of these panels until proven otherwise.
Abuse Methods (How Inventory Gets Filled)
| Method | Idea |
|---|---|
| Free-trial abuse | Mass signup → harvest credits → proxy to buyers |
| Chargebacks | Spend then reverse, or start with stolen cards |
| Prepaid cards | Fund with capped prepaid instruments |
| Open inference | Proxy through poorly guarded support chatbots |
| Denial of wallet | Flood spend with no resale motive — burn the bill |
HN added the cloud-credit cousin: unused AWS/Azure startup credits bought and resold; Lenhard said token brokers of unused credits are a follow-up piece. Same arbitrage instinct, different coupon.
Who Buys — and Why Distillation Matters
Three demand drivers in Lenhard’s read: cheap tokens, geo-restriction bypass, distillation.
Translated V2EX quotes (via his sources) claim companies with strong programming capability distill Claude; intermediaries specialize; some distillers allegedly make millions; the chain is described as multi-billion RMB. That is the consumer-facing pipe underneath industrial stories we already cover: Anthropic vs Alibaba 25k accounts, what distillation is, White House / Moonshot distillation politics.
HN’s trust problem: how do buyers know they got Fable/Opus and not a silently substituted weaker model? Reputation markets — “like cut narcotics,” as one comment put it. For distillers, wrong-model traces poison the student. For startups, “it still coded the ticket” may be enough — until prompts leak or the key dies mid-demo.
Maturity Signals (Not a Hobby Scene)
- Price-comparison aggregators (Lenhard cites getcheapai.com)
- Affiliate programs and gateway products
- Top 10 tracked relays ~3.6 million visits/month combined
- Operators bragging about tens of TB of traffic on day one (V2EX)
- hvoy.ai-style daily lottery: 50 × $100 API keys/day, check-in tickets, Bitcoin-block-hash seed + Partial Fisher-Yates “provably fair” theater
When abuse has a lottery with crypto fairness proofs, KYC is not a one-time mop — it is a migration pressure. Lenhard’s hunch: as Anthropic and peers roll identity checks (Persona KYC), abuse shifts to application-layer products and other soft targets.
What HN Debated (Worth Keeping)
Ads / impressions precedent. Token resale looks like the last generation of ad-fraud inventory markets — sophisticated actors, stolen instruments, discounted impressions.
Subscription as buffet. Flat Max plans assume humans sleep. Resellers treat every rate-limit window as inventory — suitcase-at-the-buffet economics. Counter-thread: paying for limited plates should mean you can use them; anti-consumer friction vs fraud prevention.
Fraud vs ToS breach. Stolen cards / chargebacks are clear fraud. Paying for a sub and reselling unused capacity is ToS gray / civil for many commenters — but scale usually requires automation that crosses into deception. Lenhard’s upstream layer exists because honest single-seat resale cannot hit 97% off.
Canaries vs fingerprints. Product pitches for device fingerprinting drew pushback from Lenhard: client signals are bypassable; canary values in inference and intermediate signals matter more. (We describe the idea; we do not endorse a vendor.)
Monitoring goldmine. Whoever runs a busy relay sits on compressible prompt/response traffic — a privacy and IP nightmare for anyone who “just wanted cheaper Claude.”
Defenses That Raise Attacker Cost
Lenhard’s ordered playbook (paraphrased for builders running AI gateways):
- Harder entry — bulk signup friction, automation signals, low fresh-account caps.
- Watch money — prepaid/virtual cards, mismatched billing, card-testing charges.
- Watch behavior — time-to-first-token, model mix, IP/VPN, prompt relevance where measurable.
- Cluster sybils — shared devices/IPs across “separate” accounts.
- Cost anomaly alerts — kill switches when spend spikes.
- Damage caps — spend locks, concurrency limits, reserve budget for in-flight requests, escalate KYC mid-session.
- Throttle quietly — clean errors teach attackers which signal to fix.
None stops abuse forever. The goal is to make your service unprofitable relative to the next soft target.
Builder / Buyer Checklist
- Prefer official keys or contracted enterprise for production.
- Treat mystery OpenAI-compatible base URLs as hostile until proven.
- Assume prompts on gray relays are logged and resellable.
- If you self-host one-api/new-api, audit channel inventory like you audit secrets.
- Cap free tiers hard — open signup + free credits is an invitation.
- Read KYC as anti-farm, not just bureaucracy — see ID verification.
- Separate cheap inference from trustworthy distillation data — wrong model, wrong student.
Related on explainx.ai
- AI token black market — Claude resellers at 70–93% off
- Anthropic vs Alibaba — 25K fake accounts, 28.8M exchanges
- What is AI distillation?
- Proxy-KD — black-box distillation
- White House / Moonshot Fable distillation
- Claude ID verification (Persona)
- Why AI companies want you using agents — token economics
- Claude Memory Heist — exfiltration surface
- AI cyber guardrails debate
Primary sources: Vectoral — Token relay market (Matt Lenhard) · V2EX thread t/1196011 · one-api · new-api · Hacker News discussion of the Vectoral post (Jul 2026)
Discount figures, visit counts, and lottery details are as reported by Lenhard (June 28, 2026) and contemporaneous HN debate. Marketplace actors change fast — re-verify before citing in compliance or security docs. Follow @explainx_ai for updates.