An Inside Look at the Relay Market Powering Token Resellers and Fraud

2026-07-26 · Source: Simon Willison's Weblog · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Intermediate, quick

Summary

An investigation by Matt Lenhard reveals a burgeoning relay market, primarily in China, for reselling Large Language Model (LLM) tokens at significant discounts. This market operates by pooling API keys obtained through various illicit means, including abusing free trials, exploiting unprotected support bots, and utilizing stolen credit cards or chargeback attacks. Resellers employ open-source proxy software like "one-api" and its fork "new-api" to load-balance requests across these compromised credentials. Buyers are motivated by the desire for cheaper tokens, bypassing geo-restrictions, and gathering data for model distillation. The existence of this ecosystem underscores a heightened risk for LLM-driven applications, as it incentivizes the exploitation of any new unprotected endpoint.

Key takeaway

For AI Engineers deploying LLM-driven applications, you must prioritize robust security measures and cost controls. The emergence of a sophisticated token resale market, fueled by API key exploitation, significantly increases the risk of unexpected token bills. Implement strict usage monitoring and advocate for LLM vendors to provide granular, dollar-threshold API key caps to prevent financial abuse and protect your deployments from this growing threat.

Key insights

A black market for discounted LLM tokens thrives by exploiting API vulnerabilities and free trials, posing significant risks.

Principles

• Exploitation of unprotected LLM endpoints fuels a profitable token resale market.
• LLM vendors require robust API key capping mechanisms to prevent abuse.

In practice

• Exercise caution when exposing LLM-driven applications publicly.
• Demand strict, dollar-threshold API key caps from LLM vendors.

Topics

• LLM Security
• API Abuse
• Token Resale Market
• Fraud
• one-api
• new-api
• Cost Control

Code references

• songquanpeng/one-api
• QuantumNous/new-api

Best for: CTO, VP of Engineering/Data, AI Architect, AI Engineer, Machine Learning Engineer, Director of AI/ML

Related on AIssential

• Inside The Gray Market For Llm Access — A gray market provides restricted U.S. LLM access in China, enabling discounted use but risking data and model integrity.
• LLMjacking: Detecting Leaked LLM API Keys Before the Bill — LLMjacking exploits leaked LLM API keys for unbounded financial fraud, distinct from traditional data breaches.
• CyberChainBench: Can AI Agents Secure Smart Contracts Against Real-World On-Chain Vulnerabilities? — LLM agents show promise but significant limitations in smart contract security tasks, especially patching.
• The dangers of token usage billing — Token-based AI billing creates vendor lock-in, knowledge loss, and model degradation, threatening business autonomy.
• LLM APIs are now the #1 attack surface in AI systems. — LLM APIs are the top AI attack surface due to executable intent inputs, requiring specialized security beyond traditional methods.
• How I Turned AI to the Dark Side — LLM safety mechanisms are systemically vulnerable to manipulation, allowing extraction of dangerous information across major models.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Simon Willison's Weblog.