--- title: The Dark Side of $1 AI: Inside the Underground Market... description: An investigation into China's underground 'transfer station' market where sellers on Taobao and Xianyu offer heavily discounted access to Claude, GPT, and... canonical: https://daily.dev/posts/the-dark-side-of-1-ai-inside-the-underground-market-for-pirated-ai-access-bskrrdm2s twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Dark Side of $1 AI: Inside the Underground Market for Pirated AI Access | daily.dev og:description: An investigation into China's underground 'transfer station' market where sellers on Taobao and Xianyu offer heavily discounted access to Claude, GPT, and... og:url: https://daily.dev/posts/the-dark-side-of-1-ai-inside-the-underground-market-for-pirated-ai-access-bskrrdm2s og:image: https://api.daily.dev/og/posts/BSKRrdM2S.png og:image:alt: The Dark Side of $1 AI: Inside the Underground Market for Pirated AI Access og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Dark Side of $1 AI: Inside the Underground Market for Pirated AI Access **[Medium](https://daily.dev/sources/medium_js)** · 10 min read · 0 upvotes · 0 comments ## Summary An investigation into China's underground 'transfer station' market where sellers on Taobao and Xianyu offer heavily discounted access to Claude, GPT, and Gemini through third-party API keys. Behind these cheap keys often sits a supply chain of account farming, subscription arbitrage, promotional-credit abuse, and outright stolen credentials sourced from compromised developer accounts, exposed repositories, and credential-stealing malware. Open-source gateway software like new-api and one-api enables this infrastructure by handling routing, billing, and credential pooling, letting operators swap dead credentials for new ones within minutes so the service survives takedowns. Buyers may also receive a cheaper substitute model instead of the one they paid for, and all prompts, source code, and business data passing through these proxies are exposed to unknown third parties, creating risk for both the original credential owners and the unwitting customers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do transfer stations sell access to Claude or GPT so much cheaper than official pricing? Transfer stations pool credentials from multiple sources including stolen API keys, account farming, subscription arbitrage, and fraudulent accounts, then route customer requests through whichever upstream credential is available. Open-source gateway software like new-api and one-api handles billing, authentication, and model routing, letting operators sell fractions of pooled compute at 70-90% below normal price. _Developers weighing cheap third-party AI access against security risk can track this kind of research on daily.dev._ ### Why is it hard to shut down these pirated AI API reselling operations? The ecosystem is modular: account sourcing, infrastructure, payments, and retail sales are handled by separate, independent groups. When one upstream credential is suspended, the transfer station simply routes traffic to another pooled credential, so suspending a single operator or account rarely disrupts the broader supply of accounts or customer base. _Anyone tracking how supply-chain style abuse evolves around AI credentials can follow this trend on daily.dev._ ### What are the risks of using a cheap third-party API key to access Claude or other AI models? Prompts, source code, and business data pass through the reseller's infrastructure with no meaningful privacy guarantee, and some proxies reportedly substitute cheaper models while advertising the expensive one, causing unexplained quality drops. Separately, the original credential owner can face fraudulent charges reaching into the millions before the theft is discovered. _Teams evaluating third-party AI API providers can weigh these tradeoffs using coverage like this on daily.dev._ ## Similar posts on daily.dev - [An Inside Look at the Relay Market Powering Token Resellers and Fraud](https://daily.dev/posts/an-inside-look-at-the-relay-market-powering-token-resellers-and-fraud-njahgl92o) · Hacker News · 2 upvotes · 0 comments - [Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://daily.dev/posts/token-jacking-cybercriminals-could-be-stealing-your-ai-resources-os316gpzk) · Unit 42 · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#llm](https://daily.dev/tags/llm) [View this post on daily.dev](https://daily.dev/posts/the-dark-side-of-1-ai-inside-the-underground-market-for-pirated-ai-access-bskrrdm2s) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Dark Side of $1 AI: Inside the Underground Market for Pirated AI Access","url":"https://daily.dev/posts/the-dark-side-of-1-ai-inside-the-underground-market-for-pirated-ai-access-bskrrdm2s","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-dark-side-of-1-ai-inside-the-underground-market-for-pirated-ai-access-bskrrdm2s"},"datePublished":"2026-08-20T18:06:09.971Z","dateModified":"2026-09-13T18:32:04.185Z","description":"An investigation into China's underground 'transfer station' market where sellers on Taobao and Xianyu offer heavily discounted access to Claude, GPT, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9471891b8e5503301faed53d84760822?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9471891b8e5503301faed53d84760822?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-dark-side-of-1-ai-inside-the-underground-market-for-pirated-ai-access-bskrrdm2s","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,llm","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"The Dark Side of $1 AI: Inside the Underground Market for Pirated AI Access"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-dark-side-of-1-ai-inside-the-underground-market-for-pirated-ai-access-bskrrdm2s#faq","mainEntity":[{"@type":"Question","name":"How do transfer stations sell access to Claude or GPT so much cheaper than official pricing?","acceptedAnswer":{"@type":"Answer","text":"Transfer stations pool credentials from multiple sources including stolen API keys, account farming, subscription arbitrage, and fraudulent accounts, then route customer requests through whichever upstream credential is available. Open-source gateway software like new-api and one-api handles billing, authentication, and model routing, letting operators sell fractions of pooled compute at 70-90% below normal price. Developers weighing cheap third-party AI access against security risk can track this kind of research on daily.dev."}},{"@type":"Question","name":"Why is it hard to shut down these pirated AI API reselling operations?","acceptedAnswer":{"@type":"Answer","text":"The ecosystem is modular: account sourcing, infrastructure, payments, and retail sales are handled by separate, independent groups. When one upstream credential is suspended, the transfer station simply routes traffic to another pooled credential, so suspending a single operator or account rarely disrupts the broader supply of accounts or customer base. Anyone tracking how supply-chain style abuse evolves around AI credentials can follow this trend on daily.dev."}},{"@type":"Question","name":"What are the risks of using a cheap third-party API key to access Claude or other AI models?","acceptedAnswer":{"@type":"Answer","text":"Prompts, source code, and business data pass through the reseller's infrastructure with no meaningful privacy guarantee, and some proxies reportedly substitute cheaper models while advertising the expensive one, causing unexplained quality drops. Separately, the original credential owner can face fraudulent charges reaching into the millions before the theft is discovered. Teams evaluating third-party AI API providers can weigh these tradeoffs using coverage like this on daily.dev."}}]} ```