An Inside Look at the Relay Market Powering Token Resellers and Fraud

The Spark: A tweet that exposed a hidden industry

Simon Willison recently shared an in-depth investigation uncovering a mature market for reselling LLM API tokens. As a developer who closely follows LLM application security, he confessed that this exacerbates his fear of exposing API endpoints — “there’s now an entire ecosystem that can profit from finding a new unprotected endpoint to exploit.” The article is not just a security warning; it reveals a resource black market characteristic of the large model era.

Breakdown: Where do cheap tokens come from?

The resale market operates much like software piracy in the early internet days. It consists of three core components:

1. Token sourcing: Resellers accumulate API quotas through various gray-area tactics. Common methods include mass-registering free trial accounts, tapping into public-facing support bots lacking authentication (e.g., customer service bots on Slack or Discord), or using stolen credit cards to purchase credits followed by chargebacks. These approaches yield tokens at near-zero cost.

2. Proxy distribution: They leverage open-source tools (such as one-api and its more actively developed fork, new-api) to build a unified API proxy. These tools are designed for load balancing, allowing multiple API keys to be pooled into a single entry point that distributes requests automatically. Resellers thus package fragmented “black cards” into a stable, low-cost API service sold to downstream buyers.

3. Buyer ecosystem: Buyers aren’t all malicious attackers. Some are small developers seeking lower costs; others wish to bypass geo-restrictions (e.g., using large models in regions where they aren’t officially available). More alarmingly, some buyers systematically call the API to collect data for distilling their own smaller models — effectively stealing capabilities by training a substitute on the large model’s outputs.

Trend Insight: Tokens are becoming digital “gasoline”

This reveals a larger trend: LLM APIs are turning into a scarce foundational resource, similar to bandwidth or compute, around which price arbitrage and gray markets spontaneously emerge. As long as official pricing has gaps or quota limits, there will be room for scalping — much like early cloud servers being hijacked for crypto mining or free phone numbers used for fake account registration. The difference is that the misuse of LLM tokens not only inflates costs but can also fuel model distillation, data poisoning, and other attacks, with far more severe security implications.

Moreover, the blossoming of open-source API management tools is a double-edged sword. The fact that new-api’s GitHub page contains active Chinese-language discussions indicates this ecosystem is particularly vibrant in certain regions. It suggests that infrastructure development has outpaced security norms: vendors provide powerful APIs without adequately equipping users with a strong “brake” mechanism.

Practical Value: What can developers do?

Simon’s caution is worth emulating: never assume your LLM application endpoint is safe. Even if intended for small-scale use, it can be scanned and added to a reseller’s target list. Concrete advice:

• Never expose API keys directly: Always route requests through a backend service; never embed keys in front-end code or client apps.
• Enforce hard spending caps: Unfortunately, most cloud providers’ current quota features are soft (alerts only, no hard cutoff). Developers must implement circuit breakers at the proxy or billing level — for example, halting service when the cost hits a threshold.
• Monitor for abnormal usage: Track request origins, frequency, output length, and other patterns to detect signs of proxy resale early.

As for LLM vendors, the article pinpoints a critical gap: you need to offer stricter API key controls. Providing users with a toggle that automatically disables access after $X spent would be far more effective than after-the-fact compensation.

Counterintuitive Insight: Resellers aren’t dark web hackers

Most would probably imagine a hacker-dominated underground marketplace, but the investigation shows many resellers openly operate on Chinese forums, use entirely legitimate open-source tools, and some token sources simply exploit “free trial” loopholes. This blurs the line between gray and legitimate — it’s more a grassroots economy capitalizing on rule gaps than a typical cybercrime. Recognizing this helps assess threats more realistically: the focus of protection isn’t just fending off malicious attacks but also guarding against free-riding resource abuse.