Ninety-Seven
Percent Off

The gray market that resells frontier AI into China, and the legibility it is built to defeat.

Somewhere on a Chinese programmer forum, you can buy three thousand three hundred and thirty-three dollars of official Anthropic API credit for about four hundred and twenty-five renminbi. Fifty-eight dollars, give or take. The cheapest relays advertise a median discount of ninety-seven point eight percent off list price, and they mean it.

A price like that is usually called a discount, but a discount is a thing you take out of a margin. You sell for less than you could and keep the difference small. Inference does not work that way. There is a real floor cost to running a frontier model, paid in electricity and silicon and the amortized bill for training it, and nobody can sit below that floor for long spending their own money. So the ninety-seven percent is not a margin the seller is giving up. It is a cost the seller never pays, because someone else is made to pay it. The discount is not a discount. It is a measurement of the fraud.

This essay is a reading of the market that produces that number, and it stands on someone else’s reporting. In June 2026, an engineer named Matt Lenhard published a field report for Vectoral titled An Inside Look at the Relay Market Powering Token Resellers and Fraud, after running into the abuse from the defender’s side and then stumbling onto a public thread where the operators discussed their own trade in the open. The figures here are his, and the forum voices are theirs. What I am adding is a lens the research program keeps returning to: the market is a piece of invisible infrastructure, and its most important feature is who can and cannot see it.

A relay, in the market’s own word a 中转站, a transfer station, is the shop at the end of a supply chain. It sells access to Western AI models through a clean, OpenAI-compatible endpoint, in renminbi, with recharge and invoices and a support person on WeChat. From the buyer’s side it is indistinguishable from a legitimate reseller. What makes it a relay rather than a reseller is everything standing behind it, and that stack has four layers.

The machinery in the middle is not exotic. Most relays run on one of two open-source gateway projects, one-api and its more actively developed fork new-api. An operator deploys the panel, adds channels that each represent a provider and a pool of keys, and the panel exposes one endpoint that pulls a key per request, forwards the traffic, and meters usage against a multiplier. The software is neutral, an ordinary API aggregator with legitimate uses. It becomes the engine of a fraud only when the channels are stocked with keys that were stolen, leaked, or minted from abused free trials, and the whole thing is resold against the provider’s terms. The gateway is a tool. The pool is the crime.

Here is the property that makes the market hard to kill. It is arranged so that each layer is individually plausible and legitimate-looking, and no single participant holds the whole picture. The card merchant sees cards. The pool sees accounts. The relay sees a product with a support desk. The buyer sees a cheap API and a model’s output. And the provider, the one actor with both the motive to stop it and a god’s-eye view of its own logs, sees a fog of accounts that each look exactly like a real customer, because a real card and a real signup produced every one of them.

Pick a seat below and watch the rest of the chain go dark. It is the same move One Load-Bearing Company makes with a filing: choose one vantage, and see how little of the structure any single vantage is obliged to show.

Only the last seat sees everything, and the last seat is a public forum. The structure the provider cannot resolve from the inside is narrated in plain language from the outside, complete with prices and jargon and step-by-step method, to an audience of thirty-five thousand. The market is not secret. It is merely illegible from the one chair that would act on it, which is a very different thing, and a much harder problem.

Return to the floor. If access cannot be sold below cost out of the seller’s own pocket, then every dollar of the ninety-seven percent is a dollar that comes out of a different pocket. The relay market has three main ways of reaching into other people’s.

There is a fourth abuse that does not fit the resale story because it has no buyer at all. In a denial-of-wallet attack, the point is not to obtain cheap tokens but to flood a target with concurrent requests and burn its provider spend to nothing. It is the same underlying weakness, an account whose costs are borne by someone other than the person controlling it, pointed at destruction instead of profit. And there is the softer variant of proxying traffic through a support chatbot that lacks hard guardrails, turning a helpful assistant into an open, unmetered inference endpoint. Different techniques, one structural fact: a system that lets a stranger spend your money is a system that strangers will spend your money in.

Most end users of a relay just want cheap inference. But the forum is candid that a subset of buyers are there for something with far higher stakes: distillation. They pipe a frontier model’s outputs, at gray-market prices, into the training of a domestic model of their own. In that use the relay is not a way to save money on API calls. It is a covert supply line for the one input a competitor cannot otherwise buy: the behavior of a model that cost billions to make.

Take the claim as a claim, an anonymous boast on a message board, not an audited figure. What matters for this reading is the shape it describes. When the resale channel doubles as a training pipeline, the cost being externalized is no longer just the compute for a batch of tokens. It is the research investment embedded in the model itself, extracted one API response at a time and re-cast as a rival. The stolen card funds the call; the call funds the competitor. That is a different order of loss than a cheap chatbot, and it is why the provider’s incentive to see the pool is not really about the tokens.

Bowker and Star, writing about classification, gave us the sentence this market lives inside: each category is locally honest and globally blind. Every account in the pool is a locally honest object. It has a real card, a real signup, a plausible pattern of use. Nothing about it, examined alone, is a lie. The lie is only visible globally, in the fact that ten thousand locally honest accounts are one operator, and the provider’s tools are built to examine accounts, not the space between them.

James Scott called the state’s ability to see its own territory legibility, and warned that the view from the center is always a simplification that misses what does not fit its grid. The relay market is a near-perfect inversion of his picture. Here the central actor, the provider, has more data about its own domain than any state ever had, every request logged, every token counted, and is still defeated, because the thing it needs to see is not in the data it collects. Meanwhile the periphery, the operators, enjoy total legibility of the system, and publish it. The map that would let the center act exists. It is just drawn by the other side, and posted where the center is not looking.

This is the same shape the program keeps finding. In One Load-Bearing Company, a systemic exposure lives only in the graph between the filings, and no single filing is obliged to compose it. In Seeing Like an AI Company, a firm proposes to classify the industry from above, and the question is what such a frame renders invisible. The relay market is the version where the invisibility is not an accident of disclosure but a design goal of the people building it. They have arranged the world so that the only complete picture belongs to no one who can act on it.

If the fraud is a shape and not an account, then the defense cannot be a better look at any single account. It has to be a look at the shape. The reporting lays out a defender’s playbook, and read together, its most effective moves all do the same thing: they reconstruct the relationships the market spent so much effort dissolving.

Account clustering is the load-bearing one, because it is the only lens that looks at the pool instead of the accounts. Shared device fingerprints, correlated timing, IP sybils: these link the locally honest objects back into the globally dishonest structure they belong to. Everything else, the caps on fresh accounts, the flags on virtual cards, the behavioral read on how fast a new account reaches for an expensive model, is friction that raises the cost of maintaining the pool. And the last move, silent throttling, is an epistemics move as much as a defensive one: when you catch an operator, fail quietly, because a clean error is a free lesson in which signal to route around next.