Someone Is Spending Your AI Budget and It Is Not Your Team

Matt Lenhard at Vectoral surveyed 49 token relays and published their prices. The top of the table, a storefront called Now Coding, resells frontier-model access at 97.8% below official list. I Code Easy sits at 97.1%. Claude ZZ at 96.6%, Doro at 96.4%, UoCode at 96.3%. ZeroCode and AiYa both land at 94.9%, HongMaCC at 94.2%, Right Code and BUZZ at 94.1%.

Ten of those storefronts, the highest-traffic ones, pull a combined 3.6 million visits per month.

That is a retail channel with a published price list, a customer base, and a supply problem. The supply is the interesting part. Nobody manufactures inference at a 96% discount. The inventory has to come from somewhere, and the somewhere is accounts and API keys that belong to other people.

What the Price Actually Implies

One sample package on offer: 3,333 US dollars of Anthropic credit for 425 RMB, roughly 59 dollars. A commenter in the V2EX thread Lenhard tracked worked that out to about 13 cents of official usage per dollar spent, and the figure has circulated since as if it were a measurement. It is a derivation by one forum participant, not a survey result. The raw pair is enough on its own. A reseller who can quote 3,333 dollars of credit for 59 is not arbitraging a volume discount.

Treat the rest of that thread with the same suspicion. It was opened by a relay operator, and the most quotable lines in it are anonymous boasts about multi-billion-RMB industry chains and daily earnings in the hundreds of thousands. Lenhard reports them without corroborating them, and neither should you. The defensible numbers are the ones he measured himself: the discount table, the traffic, the gateway software distribution, the lottery mechanics.

The Stack Has Four Floors and Only One Is Illegal

The market is more industrialized than “someone is selling stolen keys” suggests.

At the bottom sit the account pools. Inventory is harvested not only from lab APIs but from consumer AI application products, meaning any company that ships a feature backed by a model is upstream supply for this market whether it knows it or not. Your customer-facing chatbot is somebody’s wholesale channel.

Above that sits the gateway layer, and this is where the picture gets uncomfortable for defenders. Relays run self-hostable open-source gateways. Lenhard finds one-api appearing roughly four times as often as new-api across the relays he tracked. Both are ordinary, legitimate software. Thousands of teams run them for entirely normal reasons. Lenhard is precise about where the line falls: “A relay crosses the line when its channels are stocked with stolen, leaked, or pooled keys instead of the operator’s own.” The software is not the crime. Provenance is.

Above the gateway sits retail, with the polish you would expect from a mature market. One operator, hvoy.ai, runs a daily lottery giving away 50 API keys worth 100 dollars each, seeded from a Bitcoin block hash for provable fairness, with a published entry snapshot so participants can audit the draw. Somebody built cryptographic fairness proofs into the giveaway mechanics of a stolen-credential business.

Then comes demand: developers buying cheap coding assistants, most of whom probably do not think hard about why the price is 3% of list.

We have written before about shadow AI as an internal adoption problem and about the supply chain that forms underneath it. This is the same phenomenon viewed from the criminal side of the transaction, and it has a price sheet.

The Attacker Who Does Not Want Money

Every fraud control your finance and platform teams have built rests on an assumption: the attacker is trying to extract value. Detect the extraction, follow the value, cut it off.

Denial of wallet breaks that. The goal is to burn a provider’s budget for its own sake. There is no resale, no monetization path, no downstream buyer to trace. The attacker’s win condition is your invoice. Someone who simply wants to hurt a competitor, retaliate against a platform, or watch a rate-limited endpoint bankrupt its owner has no financial signature at all, which means the entire class is invisible to a model tuned to spot profit.

The consequence for control design is direct. Spend caps stop being a budgeting instrument and become a containment boundary, the same category of control as a network segment or a filesystem sandbox. A budget you set in order to forecast is a number. A budget that terminates execution when crossed is a wall.

Lenhard is also clear that the retail side is a moving target: “As Anthropic and others roll out KYC controls and identity verification, the abuse won’t disappear, it will just move somewhere else.” Identity verification raises the cost of stocking a relay. It does nothing about the party whose only objective was to make your meter spin.

Reserve Budget Before the Call, Not After

The blast-radius controls that survive this threat model are unglamorous: per-account spend caps, hard spend locks, concurrency limits, and quiet throttling. On that last one, Lenhard’s operational note is worth quoting exactly: “throttle quietly. A clean error just tells the attacker which signal to fix before they come back.” A 429 with a helpful message is a debugging aid for the person attacking you.

The control most teams are missing is subtler. You must reserve budget for every in-flight request, not just charge for completed ones.

Consider the common implementation. A cap of 500 dollars per account, checked against spend recorded when a call returns. An attacker fires two thousand concurrent requests. Every one of them checks the cap, sees 480 dollars of recorded spend, and passes. All two thousand execute. The cap was honored by each individual check and blown apart in aggregate, because the accounting happened after the money was already committed. This is the same shape as the self-approving agent budget: a limit that only exists at the moment of a check, with no reservation behind it, is a suggestion.

Reserving on dispatch fixes it. Decrement the account’s available budget when the request is issued, settle the difference when it returns, release the reservation on failure. Standard double-entry discipline, applied to tokens. Most teams exposing an LLM endpoint today do not have it, and the ones that do usually built it after an incident.

One caveat on sourcing. Vectoral is a threat-research vendor selling detection in precisely this space, so the defensive checklist at the end of their research doubles as a product brochure. That does not make the controls wrong. The discount table and the traffic figures are measurements you can go verify. Read the recommendations knowing who benefits when you act on them.

Do This Now

Take one production endpoint that reaches a model on your credentials. Answer three questions with evidence rather than memory.

First, what is the maximum a single account can spend in one hour if it issues unlimited concurrent requests? If you cannot compute that number from your code, you do not have a cap. You have a report.

Second, if a request is dispatched and never returns, what happens to the budget it was consuming? If the answer is “nothing until timeout,” an attacker can hold your entire cap hostage with long-running calls.

Third, when you throttle, what does the caller learn? Compare your rate-limit response to your normal response. If they differ in status code, latency, or body, you are giving free feedback to whoever is probing you.

Whatever the endpoint costs you today, assume someone eventually decides that number should be much larger, and that they will earn nothing from it. Build for that attacker. The one chasing profit is easier. If you need a starting structure for the finance side of this, our credit governance template covers the ledger discipline that sits underneath the caps.

This analysis synthesizes An Inside Look at the Relay Market Powering Token Resellers and Fraud (Vectoral, June 2026).

Victorino Group helps engineering organizations turn AI spend limits into enforceable containment boundaries. Let’s talk.