The Rise of Token Brokers: Inside the AI Credit Resale Economy
A new market has emerged around unused AI API credits, with brokers buying them from startups and reselling at steep discounts. This piece explores the ecosystem, from credit marketplaces like AI Credits to bulk-discount routers like CheapCredits, and reveals how brokers operate, often acting as proxies rather than handing over keys. With listings ranging from 30% to 80% off, the market is booming, but abuse and crackdowns loom.
Tokens have become a pseudo-currency, and there is enough liquidity in the market to allow for a lot of abuse.
- Aurornis
The original article linked in the opening has more context https://vectoral.com/blog/token-relay-market
People trading their unused credits feels more genuine, although still in violation of the agreements. The person who got into YC Startup School who was trying to resell the $2500 of credits was interesting. It wouldn’t be that hard for OpenAI to identify the IP addresses of the relays and start flagging accounts, tracing it back to the source. Risking burning your bridges with YC for a relatively small profit is a questionable decision.
The original article showed discounts ranging all the way up to 98%. At those levels it’s obviously not people reselling anything. It’s either sourced from stolen API keys, bought with stolen credit cards, or acquired through automated sign up of trial accounts if you’re actually getting the API you request.
I would expect a lot of them are reselling a different API. Sign up for Anthropic tokens and get Deepseek responses instead.
- loufe
The comments here are baffling. Is nobody seeing the easy opportunity for gathering amazing high-quality training data by inserting yourself as a MITM? If I were a competing lab, criminal, or opportunist I'd lie/cheat/steal/simply pay the difference to get the chance to listen into real life scenarios of usage of modern models in a high-impact business.
Seems a huge part of the story completely absent to me.
- nerevarthelame
Distillation is one of the most unique and interesting aspects of this.
But otherwise, if a company gives something valuable for creating an account on their platform, expect that people will automate the creation of millions of accounts. If employees of B2B partners get benefits, they will resell them. Accounts will be hacked and resold. The same basic abuse patterns are decades old for online delivery services, loyalty accounts for airline and hotels, etc. There are entire industries dedicated to those spaces as well: large organizations with physical offices, hundreds of employees, HR departments, etc. dedicated to reselling digital benefits on grey markets.
Some companies are tolerant of allowing this to happen. The pessimistic view is that even illegitimate traffic contributes to the KPIs that your investors care about. The slightly less pessimistic view is that fraud prevention will always have trade-offs and false positives, and sometimes the savings of preventing fraud are genuinely outweighed by the false positives. Or maybe it's just Hanlon's razor and they truly never saw it coming.
- vb-8448
Wait a sec, I have to trust a third party with basically no reputation, did I get it right?
It's basically asking for being hacked and/or sending you private data to random email addresses! Neither at a 99% discount I'd do it.
I understand if someone, for any reason, cannot access a specific model ... But nowadays, there are so many alternatives that even this doesn't make sense any more.
- alekstret
In my project, I pay a general price for using agent quota. For me, it's not about saving money but about being sure that I have full control over the usage limits. My product provides a pool that depends on the plan (100 or 500 requests per paying account per month), and when these credits are used, I offer a backup option to bring your own AI key to use. And last but not least, I want to be sure that users' data won't be used to train models.
- Sha1rholder
This research is way toooo shallow. He really should go check out linux.do or nodeseek.com — token resale economy there is truly breathtaking.
Edit: https://vectoral.com/blog/token-relay-market mentioned in comment.
- jeffchuber
that one platform is using a flipped chroma logo - chroma has nothing to do with this racket (source : i’m chroma’s ceo)
- veganmosfet
The reseller could use an intermediate proxy and modify the traffic like in [1], to get control of the client machine - depending on the harness permissions.
TLS terminates at the proxy (say, https://reselltokens.ai), end to end integrity is not enforced. LLM traffic contains tool calls like "bash ...", which are executed on the client machine, they can be manipulated. Secret exfil is also possible.