News · curated 27 Jul 2026
An Inside Look at the Relay Market Powering Token Resellers and Fraud
First reported simonwillison.net
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
The relay market shows an established ecosystem that profits from discovering and exploiting any unprotected LLM endpoint, making token-cap enforcement and endpoint protection essential for anyone exposing LLM-driven applications publicly.
An investigation by Matt Lenhard (surfaced by Simon Willison) details a Chinese-centered gray market that resells discounted LLM tokens by pooling API keys obtained through abused free trials, proxying through unprotected support bots, stolen credit cards, and chargeback attacks. Resellers use open-source proxy software (one-api and its fork new-api) to load-balance requests across pooled credentials, while buyers seek cheap tokens, evade geo-restrictions, and collect data for model distillation.