The Relay Market: A $0.13 Dollar for Every $1 of Official Credit

A Chinese forum operator sells a package that gives you the equivalent of $3,333 worth of official Anthropic credit for just 425 RMB — roughly $0.13 of usage per $1 spent. That's a 97.8% discount off official pricing. This isn't a flash sale; it's the standard rate in the growing underground relay market for AI tokens.

The Four-Layer Ecosystem

The market operates in four distinct layers:

  1. Upstream (卡商 / 号商) — Card and account merchants sell virtual credit cards designed to pass U.S. and European billing checks, plus bulk-registered accounts.

  2. Midstream (账号池) — Account pools aggregate hundreds of upstream accounts, manage tokens and rate limits, handle failover when accounts get flagged, and expose a single API. They don't discriminate between tokens from labs (OpenAI, Anthropic, Google) and tokens harvested from application-layer tools like Kiro and antigravity.

  3. Downstream (中转站) — Relays (transfer stations) wrap the pool's API in a clean Chinese-language product, handle billing, run customer-support WeChat groups, and compete on price.

  4. End Users — Chinese developers, startups, and SaaS companies chasing cheap inference, plus commercial buyers running model distillation.

In practice, layers blur: many operators run both the pool and the relay, and forum participants often use "pool" and "transfer station" interchangeably.

The Software Stack: one-api and new-api

Almost every relay runs on one of two open-source projects: one-api or new-api. Both are OpenAI-compatible gateways. An operator deploys the panel and adds channels (渠道), each representing a provider plus a pool of API keys. The panel exposes a single OpenAI-compatible endpoint, so buyers point their existing SDK at the relay's URL. On every request, it pulls a key from the pool, forwards it upstream, returns the response, and deducts quota priced by usage times a multiplier (倍率).

new-api is a more actively developed fork of one-api, shipping with self-service payment and recharge, plus image, video, and audio models. Across tracked relays, one-api appears roughly four times as often as new-api.

There's nothing inherently illicit about the software. Many companies self-host it to put their own accounts behind a single gateway. The line is crossed when channels are stocked with stolen, leaked, or pooled keys, and when access is resold against provider terms.

The Methods of Abuse

  • Free-trial abuse: Automate account creation to claim free credits, then proxy traffic to end users.
  • Chargeback attacks: Charge back spend after usage, or use stolen cards from the start.
  • Prepaid cards: Fund accounts with prepaid cards capped at a set limit.
  • Open inference: Proxy traffic through support chatbots without strict guardrails.
  • Denial of wallet: Fire off concurrent requests purely to burn a provider's spend, facilitated by any of the above methods.

Market Maturity and Scale

The market is surprisingly mature. There are price-comparison sites (like getcheapai.com), affiliate programs, and even gateway products. The ten highest-traffic relays pull a combined 3.6 million visits per month.

One relay directory, hvoy.ai, runs a daily lottery for API keys — 50 $100 keys per day. Entry costs 20 points (earned from a daily check-in), and the draw is "provably fair" using a Bitcoin block hash as seed and a Partial Fisher-Yates shuffle.

Defending Your Service

There's no silver bullet, but here's what works, in order of abuse travel:

  1. Raise the cost of entry: Make accounts hard to create in bulk, cap fresh account spending, check for browser automation signals.
  2. Watch the money: Flag prepaid cards, virtual cards, mismatched billing info, small card-testing charges.
  3. Watch behavior: Look for time from registration to first token, model selection, prompt relevance, account age, IP signals.
  4. Cluster accounts: Watch for IP sybils and shared device fingerprints.
  5. Monitor cost anomalies: Set alerts on AI spend to flip things off if abuse starts.
  6. Limit damage: Enforce spend caps, spend locks, concurrency limits. Reserve budget for in-flight requests. Start new accounts with low caps, let them earn higher limits with age and verified card. If risk rises mid-session, add CAPTCHA or identity verification.
  7. Throttle quietly: Don't give attackers a clean error that tells them which signal to fix.

What You Can Do Now

If you're running an AI gateway or building on top of LLM APIs, audit your token spend and look for patterns of relay traffic. Consider implementing the defense layers above. The market isn't going away — providers like Anthropic rolling out KYC will just push abuse elsewhere.