threat-research llm-security
June 28, 2026 Matt Lenhard 9 min read
Share
My Story
I’ve spent a lot of time thinking about token fraud, a problem I first stumbled upon while working as a software engineer on an AI gateway.
We faced constant abuse. At first it was free-credit abuse, where users spun up accounts en masse. Then it was our support chatbot. I started talking to friends about it and hearing stories of companies losing millions of dollars to abuse each day.
The abuse took a number of different shapes, and the abusers were relentless. I came to realize that the problem was much bigger than us. A new form of fraud had emerged, and it had become endemic to the token economy.
While researching where the abuse was coming from, I stumbled onto a Chinese forum where operators openly discussed the relays and their methods. My notes on the industry and its players are below.
So What Is a Relay?
A relay — or “transfer station” — is essentially a service that proxies traffic to U.S. models, often at a deep discount. For example, one operator’s price-comparison site listed a package that bought the equivalent of $3,333 worth of official Anthropic credit for 425 RMB — roughly $0.13 of usage per $1 spent.
Effective rate
$0.13
of official usage per $1 spent
Sample package
$3,333
of Anthropic credit for just 425 RMB
Top discount
97.8%
off official pricing, at the cheapest relay
To make that concrete, here’s how far below official pricing the relays we track actually run, ranked by discount:
How the Market Works
The ecosystem runs four layers deep, from the merchants sourcing raw accounts down to the developers buying cheap tokens:
01 Upstream 卡商 / 号商
Card & account merchants — virtual credit cards built to pass U.S. and European billing checks, plus bulk-registered accounts.
02 Midstream 账号池
Account pools — aggregate hundreds of upstream accounts, manage tokens and rate limits, handle failover, and expose a single API.
03 Downstream 中转站
Relays / transfer stations — wrap the pool's API in a clean, billed, Chinese-language product and compete on price.
04 End users
Developers, startups, and SaaS chasing cheap inference — plus commercial buyers running model distillation.
Upstream
Sitting at the top are the card merchants (卡商) and account merchants (号商). They sell virtual credit cards designed to pass U.S. and European billing checks, along with bulk-registered accounts.
Midstream
In the middle sit the account pools (账号池). A pool aggregates dozens or hundreds of upstream accounts, manages their authentication tokens and rate limits, handles failover when accounts get flagged, and exposes a single API surface that downstream relays can consume.
The inventory isn’t only model-lab accounts. Alongside direct OpenAI, Anthropic, and Google credentials are accounts harvested from the application layer.
Much of the forum’s activity centers on “reverse-engineered” access to tools like Kiro and antigravity, which are consumer products, not lab APIs. To a pool, it makes no difference whether a token comes from a lab or from an app built on one; anything that resells or exposes a model is a target.
Downstream
Downstream sit the relay / transfer stations themselves — the consumer-facing layer. They wrap the pool’s API in a clean Chinese-language product, handle billing and invoicing, run customer-support WeChat groups, and compete on price.
End users
At the bottom are individual Chinese developers, small startups, and mid-sized SaaS companies hunting for cheap inference — as well as some larger commercial buyers using the infrastructure for model distillation.
In practice these layers blur. Many operators run both the pool and the relay, and the forum’s own participants often use “pool” and “transfer station” interchangeably.
The Software Behind the Relays
Almost every relay I’ve looked at runs on one of two open-source projects: one-api or new-api.
Both are OpenAI-compatible gateways. An operator deploys the panel and adds a set of channels (渠道). Each channel represents a provider plus a pool of API keys. The panel exposes a single endpoint that matches the OpenAI API, so buyers just point their existing SDK at the relay’s URL. On every request it pulls a key from the pool, forwards it upstream, returns the response, and deducts quota priced by usage times a multiplier (倍率). It manages the users, tokens, pricing tiers, logs, and billing.
new-api is a more actively developed fork of one-api, and the difference is mostly commerce: it ships with self-service payment and recharge, plus image, video, and audio models. Across the relays we track, one-api turns up roughly four times as often as new-api; the original base is the more widespread of the two, even if new-api is the one built to sell.
There’s nothing inherently illicit about the software. one-api and new-api are neutral, legitimate tools. Plenty of companies self-host them to put their own accounts behind a single gateway with team quotas and spend tracking. A relay crosses the line when its channels are stocked with stolen, leaked, or pooled keys instead of the operator’s own, and when it resells that access against the providers’ terms.
The Methods
- Free-trial abuse. Abusers automate account creation en masse to claim free credits, then proxy that traffic back to their own end users.
- Chargeback attacks. Abusers charge back their spend after the usage period ends to recoup their costs — or use stolen cards from the start.
- Prepaid cards. Abusers fund accounts with prepaid cards capped at a set limit.
- Open inference. Any support chatbot without strict guardrails is ripe for having traffic proxied through it.
- Denial of wallet. Not strictly a relay technique, but an emerging form of abuse I’ve been tracking: attackers fire off a flood of concurrent requests purely to burn a provider’s spend. It can be facilitated by any of the methods above. The difference is there’s no financial motive.
Who Are the Buyers?
The three main use cases seem to be cheap tokens, getting around geo-restrictions and model distillation. A few relevant quotes from the forum:
From the V2EX thread · translated
From the V2EX thread · translated
A Growing and Maturing Market
I was surprised by how mature the market already is. There are price-comparison sites for the relays, affiliate programs, and even gateway products. On the forums, consumer demand looks just as strong. And these aren’t fringe operations: the ten highest-traffic relays we track pull a combined 3.6 million visits a month between them.
My hunch is that things get worse for the application layer from here. As Anthropic and others roll out KYC controls and identity verification, the abuse won’t disappear, it will just move somewhere else.
They’re Raffling Off Keys Now
A clear sign of how normalized this has become is that one of the relay directories runs a daily lottery for API keys.
The site — hvoy.ai, which otherwise bills itself as a relay authenticity checker and price-comparison tool, gives away fifty $100 API keys every single day. You earn entry credits from a daily check-in, spend 20 credits per ticket, and can buy up to three tickets a round. On the day I looked, 258 people had entered 401 tickets for the fifty keys.
hvoy.ai · daily draw for 50 × $100 API keys
Every day
50
$100 API keys given away per round
Cost to enter
20 pts
earned free from a daily check-in
A recent round
1,150
tickets competing for 50 keys
The part that got me is the fairness theater. The draw is provably fair — the same cryptographic scheme legitimate crypto-gambling sites use to prove they didn’t rig the result. The random seed is the hash of the latest Bitcoin block, winners are picked with a Partial Fisher-Yates shuffle, and the full list of entries is published as a snapshot before the draw.
How Providers Can Defend Themselves
I’ve talked to many companies facing this, and the truth is that there’s no clean fix. Fraud is a constant cat-and-mouse game. What follows isn’t a silver bullet — it’s the set of things that I’ve seen work and that others are doing, roughly in the order that abuse travels: from account creation, to detection and then to damage control.
- Raise the cost of entry. Make accounts hard to create in bulk and cap what a fresh one can spend. Check for browser-based automation signals. Any client-side detection can be bypassed, but every bit of friction raises the attacker’s cost.
- Watch the money. Flag prepaid cards, virtual cards, mismatched billing info, and small card-testing charges.
- Watch the behavior. Look for patterns no real user produces: time from registration to first token, the model selected, prompt relevance (where you can measure it), account age, and IP signals (proxy, VPN, country).
- Cluster the accounts. Watch for IP sybils and shared device fingerprints that tie supposedly-separate accounts back to one operator.
- Monitor for cost anomalies. Setup monitos and alerts on AI spend as a failsafe, so that you can flip things off if abuse does start.
Assume some abuse gets through anyway, and limit what it can cost you:
- Enforce spend caps, spend locks, and concurrency limits per account.
- Reserve budget for every in-flight request, so concurrent calls can’t blow past your limit.
- Start new accounts with low caps; let them earn higher limits with age and a verified card.
- If an account’s risk rises mid-session, add friction like a CAPTCHA or an additional form of identity verification.
And when you do catch someone, throttle quietly. A clean error just tells the attacker which signal to fix before they come back.
None of this stops the abuse for good. But if you make attacking your own service expensive enough that the numbers stop working, they’ll try to find an easier target.
Sources
All quotes are translated from a V2EX thread in the site’s Programmers section, “A comprehensive guide to AI transfer station jargon,” started by the user v2exgo (who operates the relay at terminal.pub). The thread ran from March 5 to June 23, 2026 and drew roughly 35,000 views and 190 replies. Reply numbers below refer to that thread.
- Primary source — V2EX thread: https://www.v2ex.com/t/1196011
- Price-comparison aggregator: getcheapai.com.
- Daily API-key lottery: hvoy.ai/free-tokens/lottery — 50 $100 keys drawn per day, settled with a Bitcoin-block-hash seed and a Partial Fisher-Yates shuffle.
- Operator’s relay: terminal.pub
- Effective-rate derivation: reply #50, where milkleeeeee computes the 425 RMB package as equal to the official $3,333 — about $0.13 per $1 of official usage.
Share