Summary
- Hundreds of relay brands run on shared open-source software. A self-described directory lists 452 public relay sites that sell Claude (中转站排行). The most popular gateway, new-api, has about 50.1k GitHub stars and is still adding about 500 a week (GitHub, Star History).
- Relays sell Claude at 20–50% of list price, and the cheapest claim about one-sixth. In a comparison written by a relay operator, eight relays priced a blended million Claude Opus 4.8 tokens at ¥22.8 to ¥138, against about ¥129–138 bought direct (LMUAI blog). Operators interviewed by 21st Century Business Herald put the "chaotic" tier at 20–50% of official prices (21经济网).
- The profit engine is a $200 subscription, and its margin is fragile. Operators claim one Claude Max account resells as $1,500–3,000 of API-equivalent usage (21经济网, 知乎), and Anthropic itself said one user consumed "tens of thousands" on a $200 plan (OfficeChai). Our arithmetic gives a gross margin of roughly 0–75%, depending on overselling and bans. An honest 8-seat carpool earns about 10%.
- Much of the cheapest supply is fraudulent or stolen. Anthropic says proxy networks have controlled hundreds of thousands of fraudulent accounts, one of them more than 20,000 at once (Anthropic). The 17 October OpenCode breach exposed stored API keys for 1.4% of Console users, and users reported overnight losses of $400–1,700 (BleepingComputer, X/@mweinbach).
- Buyers carry the risks of model substitution, data harvesting and lost balances. Anthropic says some proxy networks save conversations to sell to other labs, and that SenseTime bought Claude transcripts (The Hacker News). Forum advice is to top up only ¥5–10 at a time (V2EX).
- Enforcement is squeezing the arbitrage, and domestic coding plans, the obvious substitute, have raised prices. Weekly caps came in August 2025, the rule against firms more than 50% Chinese-owned in September 2025, and "preserved thinking" in October 2026, which Anthropic says cuts distillation yield by 90–99% (Anthropic, SCMP). Zhipu meanwhile repriced its GLM Coding Plan Pro from ¥149 to ¥538 a month (网易科技, 腾讯云).
Verdict
The relay economy is a large, commoditized grey market: hundreds of storefronts on a handful of open-source gateways. Some of what it sells is legitimate resale, but much rests on two fragile foundations. One is the gap between flat-rate subscriptions and per-token API prices. The other is supply that is fraudulent or stolen outright. In 2026 vendor enforcement has steadily closed the gap: weekly caps, the ban on third-party harnesses, identity-verification bans, preserved thinking and public naming of labs. Relays have adapted by selling tiered "lines" of different provenance and by refilling account pools, but operators themselves say the boom may be passing. Buyers carry most of the risk. Domestic coding plans are the natural beneficiary, though they have since raised prices toward parity with overseas plans.
Confidence: high on how the market works and how enforcement has changed (primary vendor documents plus independent press); medium on the direction (squeezed, not gone); low on size, because no audited user counts or revenue exist and most price data comes from operators' own advertorials.
The relay economy, from scratch
Note
A plain-language primer on why 中转站 exist and how their pricing works. It follows one example, a blended million Claude Opus 4.8 tokens and one $200 Claude Max account, using the same numbers as the economics section.
1. The wall
A Chinese developer who wants Claude or GPT hits three walls at once:
- Region blocks. OpenAI cut off API traffic from mainland China and Hong Kong on 9 July 2024 (The Register). Anthropic does not serve China either. In September 2025 it went further and barred any company more than 50% Chinese-owned, wherever that company operates (SCMP).
- Payments. The vendors bill in dollars to foreign cards. Chinese developers pay with WeChat Pay and Alipay.
- Identity. Accounts need a supported-region identity, and Anthropic now bans accounts from unsupported regions that fail verification (The Hacker News).
2. What a relay is
A 中转站 ("transfer station") is a website that sells you an API key and a base URL. Behind it, the operator holds the real access to Claude or GPT. You top up in yuan with WeChat or Alipay, call an OpenAI- or Anthropic-compatible endpoint, and the relay forwards your request upstream. Anthropic's own threat report now uses the literal translation, "transfer or relay stations" (The Hacker News).
Think of it as a currency-exchange booth crossed with a ticket scalper. It solves a real access problem, but you can't see where its stock came from.
3. Pricing: the "internal exchange rate" (倍率)
Relays don't quote prices per token. They quote an exchange rate: how many yuan buy one dollar of credit, which is then spent at the vendor's official dollar list prices. The market rate is about ¥7.2 per dollar. A relay quoting "rate 1" sells a dollar of list-price usage for ¥1, roughly one-seventh of the real price (LMUAI blog).
Worked example: Claude Opus 4.8 lists at $5 per million input tokens and $25 per million output. With the 30/70 input/output mix the comparison uses, one blended million tokens costs $19.
| Route | Yuan per $1 of usage | Price per blended M tokens |
|---|---|---|
| Official price via OpenRouter | ¥7.27 | ¥138.13 |
| Max-backed "official line" at one relay (our tracker arithmetic) | ¥2.9 | ¥55 |
| Cheapest relay in the comparison | ¥1.2 | ¥22.80 |
The catch is that rate 1 is only the headline. Relays also apply per-model multipliers. One relay quoting rate 1 ends up at ¥114 for Opus.
4. Why a cheap rate means cheap supply
If a relay paid list price for every token, rate 1.2 would lose about 83% on each sale. A relay selling below list has to be getting tokens below list. Four kinds of supply make that possible:
- Flat-rate subscriptions used far more heavily than the price assumes.
- Free and trial quotas: IDE plans, cloud credits and startup programs.
- Accounts registered at scale with false identities or stolen cards.
- Stolen API keys, where the cost to the relay is zero.
Only the first is "grey" rather than plainly fraudulent, and even it breaks the vendors' terms on account sharing and resale (OfficeChai).
5. The subscription arbitrage, in numbers
A Claude Max 20x plan costs $200 a month. Operators claim it yields $1,500–3,000 of usage priced at API list rates. Sell that at rate 1 to rate 2, and the account brings in ¥1,500–6,000, about $210–830. Against the $200 cost, our tracker estimates the gross margin runs from roughly 0% to 75%. A clean 8-way carpool at ¥200 a seat brings in ¥1,600, about $222, a margin of only about 10%.
6. Why it's fragile
The account is a single point of failure. If it is banned mid-month, the rest of its capacity disappears, but the buyers' prepaid yuan balances are already in the operator's pocket. Users have learned to treat a relay balance like cash handed to a market stall: top up ¥5–10 and expect the stall to vanish (V2EX).
In one line: relays exist because of access walls and survive on below-list supply. The cheaper the rate, the more likely that supply is oversold, fraudulent or stolen, which is why enforcement is squeezing the market and why buyers carry the risk.
| Value | Change | |
|---|---|---|
| Claude relay sites listed | 452 | directory, 20 Oct 2026 |
| new-api GitHub stars | 50.1k | ▲ +511 last week |
| Cheapest Opus 4.8 relay | ¥22.8/M | ▼ vs ¥138 official |
| Distillation exchanges named | ~190M | ▲ 7 China-based labs |
| OpenCode Console users exposed | 1.4% | ▲ 17 Oct 2026 |
1. How relays work: the business models
1a. Six supply channels
The clearest map comes from 21st Century Business Herald, which interviewed operators. It splits the market into three tiers (21经济网):
- Compliant resale of official API access.
- A "chaotic" tier that builds account pools from overseas accounts, harvests enterprise free programs, and resells the same account to several buyers. It typically sells at 20–50% of official prices.
- Fakes that claim to be Claude but route requests to other models. These are often run by operators who later disappear.
Forum posts fill in the supply chain: card and account dealers register accounts in bulk with virtual credit cards, those accounts go into pools, and the pools feed relays (V2EX).
| Channel | What happens (business level) | Evidence |
|---|---|---|
| Official API resale | Relay buys at list price, resells at or near list for payment convenience | Tier 1 in 21经济网; OpenRouter at ¥138.13 = list price (LMUAI blog) |
| Pooled subscriptions (拼车, "carpooling") | One Claude Max 20x or ChatGPT Pro account shared by several paying users | V2EX listing: Max 20x split 8 ways at ¥200 a seat, promising each about 2.5x Pro usage (V2EX) |
| Reverse-proxied IDE quotas | Client subscriptions of Kiro, Cursor and other AI IDEs re-exposed as an API, which leaks those clients' system prompts into responses | V2EX; Kiro and Antigravity (反重力) named as upstream sources in a relay-jargon explainer (V2EX) |
| Free and trial harvesting | Enterprise free programs and daily free credits | 21经济网; a browser extension that automates daily check-ins at relays such as AnyRouter and AgentRouter and manages many relay accounts (V2EX) |
| Fraudulent account pools | Accounts made with false identities and stolen cards, refilled as they are banned | Anthropic: hundreds of thousands of accounts, one network over 20,000 (Anthropic); a self-described card-and-account dealer advertising a pool "not afraid of bans" (V2EX) |
| Stolen keys | Legitimate customers' keys are used until the owner notices | "Illegally harvested API keys" (The Hacker News); OpenCode breach (BleepingComputer) |
Two further mechanics show up in the record:
- Refund abuse (historical). For a time, Anthropic refunded the full month when a $200 Max account was banned, whatever had been used. Some operators let bans happen on purpose so their costs went to zero. This faded once the refund policy changed, and relays moved to other cheap, bulk-registerable channels (21经济网). A Zhihu exposé makes the same point: tokens sold before a refunded ban were "pure profit" (知乎), though this is one writer's claim.
- Payment and identity arbitrage. On the buyer side, relays accept WeChat Pay, Alipay, USDT and corporate transfers (中转站排行). On the supply side, Anthropic describes accounts "under fictitious identities" paid with fake or stolen cards (The Hacker News). Moonshot's proxy accounts, for example, appeared mostly in Singapore and Japan (CNBC). The notes have no data on overseas phone-number markets.
Six supply channels feed relay storefronts. The cheaper channels range from grey (pooled subscriptions) to fraudulent or stolen, and some relays also sell saved conversations onward.
1b. The OpenCode breach
On 17 October 2026, starting at 00:30 UTC, attackers reached the stored Anthropic, OpenAI and Google keys of 1.4% of OpenCode Console users. Co-founder Dax Raad said the attackers worked on its systems for at least 48 hours using AI agents. OpenCode called it a "large-scale distillation attack" and mentioned possible reimbursement. Users reported charges from several hundred dollars up to $1,700 overnight, plus Google project suspensions. Nobody has publicly attributed who used the keys (BleepingComputer).
Max Weinbach confirmed his OpenAI and Anthropic balances were drained and his Google account limited. Others reported $400 and $1,700 losses and objected to calling key theft "distillation" (X/@mweinbach); these are claims from individual X posts. Nathan Lambert raised the same objection to lumping key theft and "model transfer stations to China" under the distillation label (X/@natolambert).
1c. The software layer
Relays are cheap to start because the plumbing is open source. One operator told 21经济网 the business needs no technical skill: anyone who can open a Claude Code or GPT subscription can run one (21经济网). There are two generations of software:
| Project | What it does | Stars | Generation |
|---|---|---|---|
| one-api (songquanpeng) | "LLM API management & key redistribution system" (key 管理与二次分发). Supports OpenAI, Azure, Claude, Gemini, DeepSeek, Doubao, GLM, Qwen; single binary or Docker (GitHub) | ~34.8k | 1: API-key gateway |
| new-api (QuantumNous) | Fork of one-api; a "unified AI model hub" that converts between OpenAI-, Claude- and Gemini-compatible formats. 12.1k forks, 344 contributors (GitHub, Star History) | ~50.1k (+511 in a week) | 1 |
| claude-relay-service (Wei-Shaw) | Self-hosted "Claude Code mirror" for Claude, OpenAI, Gemini and Droid subscriptions; advertises "carpool sharing (拼车共享) to split costs". Its successor sub2api covers Grok as well (GitHub) | ~11.9k | 2: subscription relay |
| CLIProxyAPI (router-for-me) | Wraps the Antigravity, ChatGPT Codex, Claude Code and Grok CLIs as an API (GitHub) | ~22.9k | 2 |
| Stars (k) | |
|---|---|
| new-api | 50.1 k |
| one-api | 34.8 k |
| CLIProxyAPI | 22.9 k |
| claude-relay-service | 11.9 k |
The shift between generations tells the story. First-generation tools pool and redistribute API keys. Second-generation tools turn consumer subscription sessions into an API. Together, the four repos have about 120k stars, and several top-listed relays say they are built on New API (中转站排行). For anyone building provider routing, these are general-purpose gateways; the problem is the supply they are pointed at.
Figure: new-api, the most popular open-source relay gateway, has about 50k stars and is still adding roughly 500 a week. Credit: star-history.com.
2. Economics
2a. What relays charge
The only multi-brand price table in the notes comes from an author affiliated with the relay 灵眸AI/LMUAI, so treat it as an advertorial. It was published 21 Sept 2026 (LMUAI blog). Prices are for claude-opus-4-8, weighted 30% input and 70% output:
| Relay | Rate (¥ per $1) | ¥ per blended M tokens | Note |
|---|---|---|---|
| 灵眸AI (LMUAI) | 1.2 | 22.80 | Author's own relay; monthly plan about ¥18 |
| 神马中转API | 2 | 76.00 | Stopped sign-ups and top-ups in July 2026 |
| PackyAPI | 1 | 114.00 | Model multipliers raise the price |
| poloapi | – | 124.00 | |
| laozhang.ai | – | 133.00 | |
| apiyi | – | 133.00 | |
| AIHubMix | – | 134.90 | |
| OpenRouter | 7.27 | 138.13 | Official list price |
| ¥ per M tokens | |
|---|---|
| 灵眸AI | 22.8 ¥ |
| 神马 | 76 ¥ |
| PackyAPI | 114 ¥ |
| poloapi | 124 ¥ |
| laozhang.ai | 133 ¥ |
| apiyi | 133 ¥ |
| AIHubMix | 134.9 ¥ |
| OpenRouter (official) | 138.1 ¥ |
The author puts the direct official cost at about ¥129 per million, so the cheapest relay claims about one-sixth to one-seventh of official. Two points matter:
- Most named brands sell close to list. Five of the eight are within 10% of OpenRouter. They are selling convenience (yuan payments, no foreign card), not deep discounts.
- The deep discounts cluster at the bottom and carry the most risk. 神马 (650+ models) at ¥76 shut down in July 2026, telling users to spend down their balances (LMUAI blog). 神马's ¥76 is double what rate 2 alone implies (19 × 2 = ¥38), which suggests a model multiplier (our inference).
2b. Why a $200 plan resold as API is profitable, and when it isn't
Official prices as of October 2026 are below (Morph). Max tiers now also include $100/$200 of Claude Platform API credits a month, per the same source.
| Plan | Price per month | Limits |
|---|---|---|
| Claude Pro | $20 | |
| Claude Max 5x | $100 | |
| Claude Max 20x | $200 | |
| ChatGPT Go | $8 | |
| ChatGPT Plus | $20 | |
| ChatGPT Pro 20x (includes Codex) | $200 | Weekly limits may apply; numbers not published |
The vendors have confirmed the gap is real. When Anthropic introduced weekly limits, it said "one user consumed tens of thousands in model usage on a $200 plan," and that some users were "sharing and reselling accounts" (OfficeChai). A Chinese developer estimates that a fully used ChatGPT Pro 20x plan implies about $0.016 per million GPT-5.6 Sol tokens. On that estimate it is about 36% cheaper than Kimi's ¥199 tier and about 62% cheaper than DeepSeek V4 Pro off-peak (GitHub/geoqiao).
What operators claim one Max 20x account yields:
- $2,000–3,000 of resold usage, up to $4,000–5,000 at peak (21经济网).
- $1,500–2,000 of API-equivalent usage, "about 10x margin", sliced into $5/$10/$50 "seats" (知乎), according to one Zhihu post.
our arithmetic. Assumptions: $200 cost per account; $1,500–3,000 of list-price usage resold; ¥7.2 per dollar; proxy and card overhead ignored, so these are upper bounds.
| Scenario | Revenue (¥) | Revenue ($) | Gross margin |
|---|---|---|---|
| V2EX carpool, 8 × ¥200 | 1,600 | 222 | ~10% |
| $1,500 resold at rate 1 | 1,500 | 208 | ~4%, about 0 after overhead |
| $1,500 at rate 2 or $3,000 at rate 1 | 3,000 | 417 | ~52% |
| $3,000 resold at rate 2 | 6,000 | 833 | ~76% |
| Revenue | Account cost | |
|---|---|---|
| Carpool 8×¥200 | $222 | $200 |
| $1.5k @ rate 1 | $208 | $200 |
| $1.5k @ rate 2 | $417 | $200 |
| $3k @ rate 2 | $833 | $200 |
The arithmetic shows two things:
- Honest carpooling is a thin business. The 8-seat V2EX listing earns about $22 a month per account, and its operator admits he can only refund pro-rata in a mass ban (V2EX).
- High margins need one of three things: selling more than an account can actually deliver (overselling), near-zero-cost accounts (refund abuse, stolen cards, stolen keys), or both. A ban partway through the month wipes out the account's remaining capacity, so the ban rate drives margin more than price does. One operator lost half his Max accounts to a mass ban days after launch (知乎), according to a single Zhihu post.
2c. Market size and who runs relays
- Count (unaudited data): 452 relay sites mention Claude, many created in late 2025–2026. In the directory's sample, the median relay offers 32 models (sample of 115) (中转站排行).
- Users and revenue: none published. The best indirect signals are tools built for people juggling many relay accounts (V2EX) and a resale market for balances themselves: an OpenRouter account holding $5.22 sold for ¥25 on Xianyu, according to one V2EX post (V2EX).
- Who operates them:
- Individual developers running carpools (V2EX).
- Card and account dealers moving downstream into relays (V2EX).
- Branded aggregators (the eight above).
- At least one AI lab: Anthropic says MiniMax built its own proxy service through a shell company offering Anthropic and OpenAI models, likely to collect exchanges for training (The Hacker News).
- What buyers want: most demand is for Claude specifically (21经济网).
3. Quality and risk
3a. Model substitution (降智, "dumbing down")
Substitution is common enough that relays advertise against it. A top-3 listed relay, 吉吉不降智AI (created October 2025), markets itself as the first Codex relay "without 降智", promising "full-blood" models (中转站排行). The documented substitution patterns:
- Cheaper Claude models. Some platforms quietly serve Haiku in place of Sonnet (LMUAI blog).
- Domestic models labeled as Claude. The same source reports this, and 21经济网's third tier is built on it (21经济网).
- Reverse-proxied IDE quotas. These inject the IDE's own system prompts, so behavior drifts (V2EX).
- Unverified research claims. Figures circulating in Chinese forums, traced to a study of "shadow APIs", say some relay models lost up to 40% accuracy on AIME 2025 and GPQA, made 2–4x more errors per dollar, and were used in 187 academic papers. A Zhihu headline claims 45% of tested relay models were fake (V2EX, 知乎). None of this is verified; these are secondary claims.
3b. How buyers test relays
A small industry of authenticity checkers has grown up around this:
| Tool | Method (as described) | Example result |
|---|---|---|
| claude-detector (open source) | Grades endpoints as authentic, third-party proxy, reverse-proxy or counterfeit; infers the channel (official, subscription, Bedrock/Vertex, reverse-proxy), as Veridrop describes it | – |
| Veridrop | Checks Claude's server-side encrypted thinking "signature", which relays cannot forge, plus 32k–200k-token long-context probes to catch truncation or small-window stand-ins (Kiro, Amazon Q, Bedrock) | In a sample report, one relay scored 72/100, passing 7 of 12 checks |
The directory's own buyer advice is to check how Sonnet and Opus versions are mapped, how cache billing works, and whether long outputs and tool calls are stable (中转站排行). For agent workloads, tool calls are exactly where a substituted model fails first.
3c. Logging and data exposure
This is the risk the primary evidence supports best. Anthropic says: "Some proxy networks both provide Claude access to users in unsupported regions, and also save exchanges in order to sell them to other labs." It describes a secondary market for transcripts, saved without users' knowledge. SenseTime (GTG-16012) bought Claude transcripts from third-party data vendors (The Hacker News). Other accounts:
- A card-dealer relay says it logs only timestamps, model and token counts (V2EX); this is one forum post's claim and can't be verified.
- One operator says he was offered money for his users' data and refused (V2EX); this is one forum post's claim.
Anyone sending proprietary code through a relay should assume it may end up in a training set.
3d. Bans, lost balances, reliability
- Lost balances: commenters advise being "ready for relays to run away at any time" and topping up only ¥5–10 (V2EX). 神马 told users to spend down their balances when it closed (LMUAI blog). Fake-tier operators often disappear (21经济网).
- Detection and mass bans: relay traffic from subscription-relay software is reportedly easy for Anthropic to fingerprint at the network level, and mass bans have taken down large shares of operators' accounts (知乎), according to one Zhihu post.
- Reliability (directory sample data): median uptime 97.2% (sample of 98), median latency 6.5 s (sample of 97) (中转站排行). 97.2% uptime is about 20 hours of downtime in a 30-day month (our tracker arithmetic).
- Credential theft: one documented fake reseller installed a credential harvester on its customers' machines (section 6).
4. Crackdowns and how relays adapted
| Date | Action | Who | Source |
|---|---|---|---|
| 9 Jul 2024 | API traffic blocked from mainland China, Hong Kong and other unsupported regions | OpenAI | The Register |
| 28 Jul 2025 (effective late Aug) | Weekly limits on Pro and Max, citing account sharing and resale | Anthropic | Slashdot, OfficeChai |
| Early Sep 2025 | Firms more than 50% owned by Chinese (or Russian, Iranian, North Korean) entities barred worldwide | Anthropic | SCMP |
| Undated | Full refunds on banned Max accounts ended | Anthropic | 21经济网 |
| Feb 2026 | Report names a proxy network running more than 20,000 fraudulent accounts | Anthropic | Anthropic |
| 5 Apr 2026 | Claude subscriptions stop supporting third-party harnesses such as OpenClaw (Boris Cherny) | Anthropic | 21经济网 |
| 10 Sep 2026 | Threat report names seven China-based labs and about 190M exchanges. Reseller and unsupported-region accounts banned on failed ID checks; reasoning shown only in summary | Anthropic | Better Stack, The Hacker News |
| 12 Oct 2026 | "Preserved thinking" with Claude Fable 5.1 and Opus 5.5: API accounts created on or after 31 Aug 2026 can't edit Claude's prior context. Anthropic claims 90–99% less distillation yield | Anthropic | Anthropic |
Anthropic dominates the record. The notes have little on OpenAI after 2024 beyond unpublished weekly limits on ChatGPT Pro (Morph); we found no documented OpenAI account sweeps.
The threat report's scale. About 190M exchanges came from seven labs, with Alibaba alone over 151M (Better Stack). Per-lab detail (The Hacker News, CNBC):
| Lab | Exchanges | Accounts and pattern |
|---|---|---|
| Alibaba-affiliated cluster | >151M total; peak ~3M a day | 3,500+ accounts |
| Moonshot | 23M (May–Jul 2026) | Silently relayed nearly 300,000 Kimi customer requests to Claude over 10 days via 5,380 accounts, mostly in Singapore and Japan |
| DeepSeek | 12.1M in 14 days (Jul 2026) | Same rerouting pattern as Moonshot |
| Zhipu | 3.4M | Rotated through 273 accounts |
This is substitution in reverse: users thought they were getting Kimi and got Claude. Lambert called it "a shady pattern" distinct from distillation (X/@natolambert). An X post claimed distillation traffic was 5–7% of Anthropic's $16.8B quarter (an unverified estimate from the same thread).
Two other pressures bear on relays. Weekly ceilings are themselves contested: an expanded class action says Max's multipliers apply to 5-hour sessions, not weekly limits. Anthropic published weekly hours in July 2025 (Max 20x: 240–480 Sonnet hours a week) and later stopped (The New Stack). Every cut in weekly capacity shrinks what a pooled account can resell.
How relays adapted (documented):
- Self-replenishing account pools advertised as ban-proof (V2EX).
- Swap-or-refund promises from carpools (V2EX).
- "No 降智" positioning as a selling point (中转站排行).
- Exits: some relays closed (神马), and the operator 夏达 said in May the boom "may be passing" (21经济网).
Preserved thinking applies only to accounts created on or after 31 August, which targets exactly the fresh-account churn that pools depend on (Anthropic).
Vendor enforcement from 2024 to 2026 has steadily narrowed the access gap and the subscription arbitrage that relays depend on.
5. Domestic substitutes: demand moves, prices follow
Domestic coding plans were explicitly marketed as Claude Code substitutes (平替). In early 2026 GLM plans started at ¥49 a month, with promotions as low as ¥20 advertising "3x Claude Pro" quota (腾讯云). A directory lists 7+ Anthropic-compatible domestic plans that work inside Claude Code: Zhipu GLM, Kimi from ¥49, Volcano Ark from ¥9.9, MiniMax, Alibaba Cloud and OpenCode Go (coding-plan.org).
Then prices rose. Around 30–31 July 2026, Zhipu switched from prompt counts to token credits (网易科技):
- List prices rose sharply: Lite ¥49 → ¥118, Pro ¥149 → ¥538, Max ¥469 → ¥1,078.
- That ended the earlier "flash-sale, must grab" scarcity.
- Domestic prices now match the overseas Z.ai tiers ($18/$80/$168).
- Legacy subscribers keep the old prices until renewal.
- Displayed discounted prices are ¥94.4/¥430.4/¥862.4, with 20% off quarterly and 30% off annual plans (腾讯云).
| Before | After | |
|---|---|---|
| Lite | 49 ¥ | 118 ¥ |
| Pro | 149 ¥ | 538 ¥ |
| Max | 469 ¥ | 1,078 ¥ |
Kimi membership with Kimi Code, as of 14 Oct 2026, is Plus ¥99, Pro ¥199 and Max ¥699 a month (¥79/¥159/¥559 a month billed annually), with K3 up to 1M context from Pro (coding-plan.org).
Reading this carefully. The notes contain no direct measure of demand moving from relays to domestic plans. What they show:
- Domestic plans positioned themselves as Claude Code replacements.
- At least GLM was oversubscribed enough to need flash sales.
- Prices were then raised 130–260%.
Epoch AI estimates China's six leading AI firms earn about 10% of OpenAI plus Anthropic's AI revenue (Epoch AI). That explains why launch pricing below cost could not last. There is also an irony: two of the labs selling domestic substitutes were, per Anthropic, quietly serving Claude to their own customers in mid-2026 (CNBC).
6. Beyond China
The pattern is global, though the notes document it as threat-intelligence cases rather than as a storefront market like China's:
- Fake resellers (Russia/Ukraine). GTG-50021, a Russian- or Ukrainian-speaking group (alias "kl1zy"), ran discounted "Claude" resellers. They silently proxied traffic to a different model while their tooling installed a credential harvester, and the stolen Anthropic credentials were sold to other proxy resellers (Anthropic). An independent Japanese analysis summed it up: the reseller "was neither cheap nor Claude" (note.com).
- Biological-misuse cases. A reseller platform evaded regional blocks to serve virologists on a state-sponsored grant, and later routed refused prompts to more permissive models (Anthropic). Two of the report's five biological-misuse cases involved access through resellers (note.com).
- Account geography. Moonshot's 5,380 accounts appeared mostly in Singapore and Japan (CNBC). Anthropic bans reseller accounts from China, Iran and Russia that fail verification (The Hacker News).
- LLMjacking, the Western version of key pools. ShinyHunters affiliates stole AI API keys from enterprise vendors and used one key for about three weeks. Credential pipelines scanned 1.8 million Android APKs for hardcoded secrets (Anthropic). The OpenCode breach shows that keys stored by Western developer tools are part of the same pool (BleepingComputer).
Gap: the notes contain no counts or price lists for subscription-resale markets outside China.
What to watch
- Relay count and tooling growth: whether the directory's 452 Claude relays shrinks, and whether new-api's roughly +500 stars a week slows (中转站排行, Star History).
- Preserved thinking coverage: whether Anthropic extends it beyond accounts created on or after 31 Aug 2026, and whether the cheapest relay rates (currently ¥1.2 per $1) rise in response (Anthropic, LMUAI blog).
- OpenCode follow-up: reimbursement decisions, any attribution of who used keys from the 1.4% of affected Console users, and copycat breaches at other tools that store keys (BleepingComputer).
- Domestic plan pricing: GLM legacy users renewing at ¥538 for Pro (vs ¥149), and whether Kimi's ¥199 Pro tier or Volcano Ark's ¥9.9 entry plan moves (网易科技, coding-plan.org).
- Weekly-limit litigation: the Claude Max class action, which could force Anthropic to publish weekly numbers again; those numbers set the resale ceiling of a pooled account (The New Stack).
- The next Anthropic threat report: new account-network sizes (the current record is 20,000+ in one network) and any first OpenAI-side disclosure (Anthropic).
Sources
- Anthropic, 2026-10-12: Strengthening our defenses against distillation attacks
- Anthropic, 2026-09-10: Detecting and countering misuse of AI: September 2026
- Better Stack, 2026-09-14: Anthropic's September 2026 Threat Report: Illicit Distillation and the Labs Behind It
- The Hacker News, 2026-09-11: Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks
- CNBC, 2026-09-11: Chinese AI labs secretly used millions of Claude exchanges to train their models, Anthropic says
- BleepingComputer, 2026-10-19: OpenCode hack exposes API keys amid AI distillation attacks
- X (@mweinbach), 2026-10-17: Post on drained balances
- X (@natolambert), 2026-10-17: Post on Kimi serving Claude tokens
- 中转站排行, 2026-10-20: 2026 Claude 中转站推荐：452 家 API 中转站对比
- LMUAI blog, 2026-09-21: Claude 中转站怎么选：8 家横向对比与避坑点（2026-09）
- GitHub, 2026-10-20: QuantumNous/new-api
- Star History, 2026-10-20: QuantumNous/new-api
- GitHub, 2026-10-20: songquanpeng/one-api
- GitHub, 2026-10-20: Wei-Shaw/claude-relay-service (also sub2api, CLIProxyAPI)
- The Register, 2024-06-25: OpenAI to pull plug on 'unsupported' nations from July 9
- SCMP, 2025-09-05: US start-up Anthropic blocks Chinese firms' subsidiaries worldwide from AI access
- Slashdot, 2025-07-29: Claude Code Users Hit With Weekly Rate Limits
- OfficeChai, 2025-07-29: Anthropic Introduces Weekly Rate Limits For Claude Pro and Max Subscribers
- The New Stack, 2026-09-08: Anthropic promised 20x more usage. Then developers hit a weekly ceiling.
- Morph, 2026-10-06: Codex Pricing 2026
- 21经济网, 2026-05-06: Token经济红利背后，隐秘的中转站生意
- 21经济网, 2026-05-19: 倒卖token变成一门生意，风口站满国内"黄牛"
- 知乎, 2026-05-23: 揭秘中转站：45% 假模型，9个投毒，1个偷币，还有一群活在中间层的人
- V2EX, 2026-06-22: 自己开发了一个 claude max 拼车中转站，每月 200/2.5 倍 pro 用量
- V2EX, 2026-03-16: 卡商+号商自建的 Claude API 中转站
- V2EX, 2026-03-22: ［无广］ AI 中转站的底裤，扒给你看
- V2EX, 2026-10-20: [开源] All API Hub
- V2EX, 2026-01-06: API 中转站测评
- Veridrop, 2026-10-01: Claude API 中转站真假检测
- note.com (香川友志), 2026-09-12: Anthropic 'Threat Intelligence Report September 2026' Full Analysis
- 网易科技, 2026-07-31: 智谱GLM Coding Plan不用抢了，最多涨价两倍，价格向海外看齐
- 腾讯云开发者社区, 2026-07-29: 智谱GLM Coding Plan改版：Pro档涨幅超150%
- coding-plan.org, 2026-10-14: Kimi 会员与 Code 2026
- GitHub (geoqiao), 2026-09-05: 2026 AI 编程订阅对比：Codex、Claude Code、Kimi 怎么选？
- Epoch AI, 2026-10-06: How do Chinese AI companies make money?