Matt Lenhard published an investigation into a parallel market reselling tokens from major model APIs at steep discounts. Resellers, mostly active in China, use open source proxy software like one-api and its fork new-api to accumulate API keys from multiple sources: free trials exploited to the limit, exposed support bots, stolen credit cards, targeted chargebacks. Buyers seek cheap tokens, circumvent geographic restrictions, and in some cases collect outputs to train their own models via distillation.

Why it matters to you. If you’re building something that exposes an LLM API to the public, this market is a direct incentive to find your endpoint and exploit it. The existence of an ecosystem that monetizes unauthorized access makes every exposure more risky. The concrete problem is that many providers don’t offer rigid, configurable spending caps: you’d like your app to stop at a dollar a day, but you discover you can’t lock it down precisely. Anomalous consumption in your dashboard could signal that someone found a gap.

If you want to try. Check your provider’s dashboard: review configurable spending limits on active keys, and delete the ones you no longer use.

In detail

The relay market is not an isolated novelty. It’s existed since LLM tokens have had a price, but Lenhard’s investigation is the first to map its value chain with concrete names and tools.

How the chain works. Resellers collect API keys from multiple sources and load them into a proxy. The main software is one-api, a legitimate open source project designed to balance requests across multiple credentials. Its most active fork, new-api, adds functionality. Both are sound tools in themselves: the problem is the origin of the keys that end up in them.

According to Lenhard, key sources fall into three categories. Free trials from providers, created and consumed en masse with temporary accounts. Corporate support bots left exposed without adequate authentication, which someone discovers and uses as a free entry point. And then financial fraud: stolen cards to open paid accounts, and organized chargebacks to cancel payments after consuming tokens.

Who buys and why. Buyers are mostly in China and seek three things. Low-cost tokens for their own projects. Access to models with geographic restrictions, like US providers that block Chinese IPs. And output data for distillation, the process of training a smaller model on responses from a larger one, which frontier labs prohibit in their terms of service.

The infrastructure’s weak point. The practical problem for builders is that major providers don’t offer spending caps with sufficient granularity. If an agent or app gets compromised, the financial damage can grow before you notice. The ask is simple: a switch that stops spending at a threshold you’ve set. For those about to ship an agent to production, the lesson from our course on costs, latency, and security starts here: spot risks before exposing anything to the public.

What’s known and what remains open. The investigation relies on a Chinese forum thread as its primary source, and the phenomenon appears concentrated in the Asian market. There are no quantitative estimates of the market’s size, nor verified data on the volume of fraudulent tokens. What we know is that the tools exist, are open source, and the economic incentive to use them is real. The chain of trust in AI infrastructure had already fractured with the evaluation incident between OpenAI and Hugging Face, but the relay market shows a different level of industrial organization: not an isolated breach, but an ecosystem actively seeking exploitable endpoints.