An Inside Look at the Relay Market Powering Token Resellers and Fraud

An investigation by Matt Lenhard reveals a thriving market in China centered around reselling discounted large language model tokens by pooling API keys from various sources. These resellers offer access to LLM proxies at prices significantly lower than standard API rates.

Resellers acquire their cheap access by exploiting free trials, routing traffic through unprotected customer support bots, and occasionally using stolen credit cards or executing chargeback attacks. To manage these operations, they rely on open source proxy software such as one-api and its actively developed fork, new-api, which allow them to balance requests across pools of credentials.

The buyers in this market include individuals looking for cheap tokens, users trying to bypass geographic restrictions, and entities gathering data for model distillation. This ecosystem poses a significant security challenge for developers who expose LLM applications publicly and fear massive, unexpected token bills resulting from exploitation.

The findings highlight an urgent need for LLM vendors to improve platform security by offering strict, reliable spending caps for API keys. Developers require systems that automatically halt LLM applications the moment a predetermined dollar threshold is reached within a specific timeframe.