Inside the Black Market Reselling Stolen LLM API Access

Simon Willison flagged an investigation this week that's worth the attention of anyone building on top of hosted LLM APIs: a detailed look by Matt Lenhard, published on Vectoral, into a market for reselling LLM tokens at a steep discount. The trail runs mostly through Chinese-language forums — Lenhard's primary source is a thread on v2ex.com — and it maps out something more organized than a handful of opportunists sharing a leaked key.

What the relay market actually is

Resellers stand up proxy servers that sit in front of a pool of API credentials and sell discounted access through that proxy. From the buyer's side it looks like a normal API endpoint, just cheaper than going direct. The pool behind it, though, isn't paid-for capacity — it's sourced through free-trial abuse, credentials pulled from unprotected customer-support bots, and in some cases stolen credit cards or chargeback fraud, where a card is used to buy credits and then disputed after the tokens are already consumed.

Real open-source tools, repurposed

The proxy layer itself isn't bespoke malware — it's built on one-api and its fork new-api, both legitimate open-source projects designed to let teams load-balance requests across multiple API keys and providers. That's the uncomfortable part: the software is the same kind of gateway a lot of teams run internally to manage cost and rate limits across model providers. The difference is entirely in what credentials get fed into it and how they were obtained.

Why buyers show up

The obvious draw is price, but Lenhard's investigation points to two other motives that matter more for builders: bypassing geographic restrictions on certain models, and harvesting large volumes of outputs for model distillation — training a smaller model to imitate a larger one's behavior. Both are quieter, longer-running abuses than a one-off cost-saving hack, and neither shows up as an obvious spike unless someone's watching for it.

The builder's takeaway

None of this requires a sophisticated attacker. An unprotected support chatbot wired to an LLM API with a live key behind it is, functionally, an unauthenticated API endpoint — and this market exists specifically to find and monetize exactly that kind of oversight. If you're shipping anything with an LLM in the loop — a support bot, an internal agent, a demo environment — the questions worth asking are boring but concrete: is the key scoped to only what that surface needs, is there per-caller rate limiting, does usage get monitored for the kind of steady, high-volume pull that free-trial abuse or distillation scraping produces, and can a compromised or leaked key be rotated without a deploy. Vibecoding an LLM feature fast is fine; shipping it without basic key hygiene is how you end up funding someone else's resale business.

This looks to be mostly a thing in China. Resellers sell access to an LLM proxy that offers significant discounts on regular API pricing, which they achieve by abusing free trials, proxying through unprotected support bots, or sometimes through stolen credit cards or chargeback attacks.

— Simon Willison, summarizing Matt Lenhard's investigation