Inside the LLM Token Resale Market: Fraud and Discounts Behind the Ecosystem
Score
78揭露了LLM Token转售的灰色市场具体运作机制，对多数读者而言是新鲜信息。
调查有明确信源、技术细节和实际案例，写作清晰、客观。
对使用LLM API的开发者提供了直接安全建议，可立即采取行动。
文章刚刚发布，涉及当前AI产业的热点安全问题。
来源为知名技术博客Simon Willison，且引用Hacker News和中文论坛，可信度较高。
Base 86.5 × T2 Source weight ×0.9 = 78
Curation line 70Selected
Why selected
Exclusive and in-depth investigation with significant security implications for the AI industry, though primarily focused on China with limited global applicability.
AI commentary
「As an editor, I believe this article is a wake-up call for every developer consuming LLM APIs. It reveals a dark side we might overlook: once an API key is exposed, it becomes a target for a complete black-market ecosystem. Notably, resellers use legitimate open-source proxy tools, making defense trickier. I strongly urge everyone to immediately review their API key cap settings and consider deploying anomaly detection. This piece is a must-read for companies running public AI services.」
Quick overview
Matt Lenhard's investigation reveals a gray market for reselling LLM tokens at deep discounts. Resellers use open-source proxy software like one-api and new-api to pool API keys from various sources, abusing free trials, unprotected support bots, stolen credit cards, or chargeback attacks. This market is predominantly based in China, with buyers seeking cheap tokens, bypassing geo-restrictions, or collecting data for model distillation. The report warns LLM developers to enforce strict API key caps to avoid abuse and huge bills.
- Resellers pool API credentials using open-source proxies (e.g., one-api, new-api) to load balance and resell at a discount.
- Fraud tactics include abusing free trials, exploiting unprotected support bots, stolen credit cards, and chargeback attacks.
- Buyers seek cheap tokens, bypass geo-restrictions, or collect data for model distillation.
- LLM developers must set strict usage caps on API keys to mitigate such abuse risks.
Full text
Showing the source text; the full translation is being generated.
An Inside Look at the Relay Market Powering Token Resellers and Fraud
Fascinating investigation by Matt Lenhard into the market that has grown up around reselling LLM tokens at a discount by pooling API keys from various sources.This looks to be mostly a thing in China. Resellers sell access to an LLM proxy that offers significant discounts on regular API pricing, which they achieve by abusing free trials, proxying through unprotected support bots, or sometimes through stolen credit cards or chargeback attacks.
The software they are using for these proxies is open source - mostly one-api and its more actively developed fork new-api, both legitimate API proxy products which can be used to load. balance requests across a pool of API credentials.
The buyers are seeking cheap tokens, avoiding geo-restrictions, and in some cases collecting data for model distillation.
I've been cautious about exposing my own LLM-driven applications publicly out of fear of abuse leading to big token bills. The existence of this marketplace makes me even more cautious: there's now an entire ecosystem that can profit from finding a new unprotected endpoint to exploit.
LLM vendors really need to get better at offering strict caps for their API keys. I want my LLM apps to stop working the moment they hit a dollar threshold I've set for a period of time.
Here's the (Chinese language) forum thread that served as the principal source for Matt's article.
Via Hacker News
Tags: ai, generative-ai, llms, llm-pricing, ai-ethics, ai-in-china
Related items
89
FeaturedOpenAI Research: AI Is Redefining Job Boundaries
OpenAI研究：AI正在重新定义工作边界
If you care about the real impact of AI on work, this research is a must-read. Instead of theory, it uses data to show how ChatGPT users expand their task scope, offering direct insights for HR, managers, and every professional looking to upgrade their skills.
87
FeaturedOpenAI CFO Shares Five Lessons for Building an AI-Native Finance Function
OpenAI CFO 分享构建 AI 原生财务职能的五大经验
As an editor, I find this article uniquely valuable because it comes from a finance chief at an AI leader, not an external consultancy, making it highly practical. I recommend it to finance digitalization leads, CFOs, and anyone interested in AI-driven transformation.
87
FeaturedScientific Computing in the Age of Agentic AI: OpenAI Releases New Field Report
智能体AI时代下的科学计算：OpenAI发布新领域报告
This report is one of the most practical analyses in the current AI agent wave, especially suitable for practitioners in computational biology and drug discovery. It answers the key question 'What can AI agents do besides writing code?' and directly demonstrates productivity gains in complex scientific computing.
87
FeaturedReal World VoiceEQ: Measuring the Human Quality of Voice AI
Real World VoiceEQ：量化语音AI的人类自然度
What's noteworthy is that this benchmark truly focuses on the soft metric of 'human-likeness', not traditional speech recognition rate or MOS scores. For teams working on speech synthesis, voice cloning, or voice interaction, this is a highly practical reference tool that quickly identifies model deficiencies in emotion, prosody, etc. However, language support is currently limited; looking forward to future expansion.
85
FeaturedOpenAI Introduces AI Age Scorecard: A New Way to Measure ROI
OpenAI 推出AI时代记分卡：衡量投资回报的新方法
This blog post hits a sore point in the current AI industry: how to quantify input-output. For enterprise decision-makers deploying or planning large-scale AI, it helps avoid herd mentality. My personal advice: try defining 'useful work' based on your own business scenario, and avoid designing metrics that are merely formality.
85
FeaturedHow to Manage AI Investments in the Agentic Era: Focus on Useful Work per Dollar and High-Value Workflows
代理时代如何管理AI投资：聚焦每美元有用功与高价值工作流
This article is especially important for enterprises scaling AI agents. It reminds us that focusing solely on falling API prices is a trap; what really matters is the return per unit of work. I recommend CTOs and CFOs read it together and establish quantitative evaluation mechanisms internally.
85
FeaturedDesigning Organisations That Can Keep Up With AI: Organisational Latency as the Biggest Barrier
设计能跟上AI的组织：组织延迟成为最大障碍
What makes this article truly worth following is that it raises a neglected bottleneck: no matter how strong the technology is, if the organisation can't keep up, it's useless. For CTOs, CIOs, and transformation leaders, this is a more important framework than tech selection.
84
FeaturedRuff v0.16.0 Released: Default Rules Jump from 59 to 413, CI Pipelines Need Attention
Ruff v0.16.0 发布：默认规则从59条激增至413条，CI工作流需关注
For Python developers, this is an unmissable update signal. The significant increase in Ruff's default rules means we can no longer ignore potential issues in our code, and AI fix tools can lower the upgrade cost. Notably, Astral (OpenAI) is deeply integrating AI coding capabilities with static analysis tools, which may become the norm in future engineering practices.