Chinese gray market sells Anthropic Claude tokens at 10% of list price

Despite all that, Chinese developers are reportedly buying Claude tokens at roughly 10% of list price. An analysis published on ChinaTalk by Zilan Qian, a researcher at the Oxford China Policy Lab, took a close look at how this is happening.

The 'transfer station' workaround

Chinese developer communities call this workaround a "transfer station." An API proxy hosted on a server outside China takes a user's request, forwards it to Anthropic as if it came from an approved region, and relays the response back. Users just pay in yuan through WeChat or Alipay—no VPN or foreign credit card required. The market is open enough that community-run rankings already track which transfer stations are cheapest and most reliable.

Qian believes Chinese AI labs looking to mimic Western models are likely part of the demand—using outputs from a stronger model to quickly improve a weaker one of their own, a practice known as knowledge distillation. But the actual user base is much broader than that. It includes students, researchers, developers, corporate employees, app builders, and hobbyists, and resellers on Chinese e-commerce platforms like Taobao are selling this access as if it were a regular product.

A supply chain divided from account brokers to SMS verification

Qian's analysis frames the transfer station as just one link in a much larger supply chain. Upstream, there are account brokers who mass-produce Anthropic accounts, SMS verification platforms that supply foreign phone numbers, and reverse engineers who study how Anthropic detects abuse. Downstream, developers, companies, and resellers buy and resell the access. Most participants only handle one or two steps in this chain, so shutting down a single operator leaves the rest of the upstream account pool and downstream customer base untouched. Replacement services reportedly reappear within hours.

Even Anthropic's recently introduced KYC verification—requiring a government ID and a live selfie—already has workaround infrastructure built around it, according to Qian. Operators use AI to generate convincing fake IDs and deepfakes to pass biometric checks. When even that fails, some reportedly recruit real people in low-income countries to complete the verification on someone else's behalf—a claim Qian based on informal conversations and publicly available material. She pointed to Worldcoin's black market for iris-based identity verification as a precedent, noting that iris scans from Cambodia and Kenya have sold for under $30.

How prices get pushed down to 10%

Proxy operators combine several tactics to cut prices this far.

Tactic	Method
Free-credit farming	Mass-harvesting the $5 free credit Anthropic gives new sign-ups
Discount abuse	Fraudulently claiming corporate or education discount eligibility
Subscription splitting	Dividing a single $200/month Max plan's token allowance among multiple users
Fraudulent-payment accounts	Accounts possibly created with stolen or fraudulently used credit cards (scale unconfirmed)

On top of that, there's "model swapping." Because the proxy sits between the user and Anthropic, it can quietly redirect a request meant for Opus 4.7 to a cheaper model like Sonnet, or even to a Chinese model such as Alibaba's Qwen. A paper from the CISPA Helmholtz Center for Information Security that examined 17 API proxies found this kind of swapping to be widespread. In one case, an endpoint labeled "Gemini-2.5" scored just 37% on a medical benchmark—far below the official score of 83.82%. Chinese communities reportedly call this practice "dilution."

The real worry: logs as a revenue stream

The risk Qian considers most significant is the monetization of usage data. Every request routed through a proxy can expose its prompt, response, tool calls, and even iteration history to the operator. For coding agents, that means even more context—entire codebases and workflows—gets exposed. Logs like these are valuable as training or distillation data. Qian notes that datasets of Claude Opus 4.6 reasoning outputs with unclear provenance are already circulating on Hugging Face. Some in the Chinese developer community reportedly say that selling tokens is just a way to attract customers, and the real margin is in the logs—though Qian is careful to note there's no evidence yet that operators are systematically collecting and selling this data.

Qian argues the problem extends beyond US-China tech rivalry, because the methods a developer uses to get around regional blocks are structurally identical to what a bad actor would use to access top-tier models untraceably. Once a request passes through a proxy, Anthropic initially only sees the proxy's account and IP address—not the actual end user. That can blind monitoring systems like Clio, which are designed to catch patterns of coordinated abuse across accounts and conversations, especially when activity is spread across multiple proxy accounts and broken into small, inconspicuous requests.

Anthropic has already faced distillation attacks

This workaround infrastructure hits Anthropic's business directly. The company previously uncovered large-scale distillation attacks by DeepSeek, Moonshot, and MiniMax, tracing more than 16 million requests back to over 24,000 fake accounts. Anthropic cut off service to China-controlled companies and blocked workarounds through subsidiaries. Alibaba, for its part, banned employees from using Claude Code after hidden code was found in it that could identify Chinese users.

But not everyone in the industry sees distillation as a problem. Mark Zuckerberg has said that learning from everything observable is a principle worth defending—a stance that seems to extend to distilling rival models too. As our earlier coverage of the price war showed, the rise of Chinese models is already reshaping OpenAI's and Anthropic's pricing. In late July 2026, 25 companies including NVIDIA, Microsoft, and Meta spoke out against hasty regulation of distillation. Given that pushback, it seems unlikely the US government would move to regulate distillation on its own merits; any action would more likely come dressed up as cybersecurity or China-containment policy. For now, it's left to individual AI companies to enforce their own terms of service and defend themselves—and as Qian's analysis shows, that defense is still porous and easily breached by illicit means.

Editor's take

What's interesting here isn't that Anthropic built the industry's strictest gatekeeping and still got breached. It's how it got breached. Selfies, IDs, and foreign card checks are all safeguards at the sign-up stage. Transfer stations bypass them by operating at the traffic layer after sign-up, meaning they don't have to defeat those safeguards at all—they just route around them. No matter how tight the access controls are, the moment a request passes through a proxy, all Anthropic sees is the intermediary's account and IP, not the actual end user. That's the structural weakness at the heart of this.

Back in the OpenAI era, sharing API keys or using a VPN to get around restrictions was mostly an individual-level workaround. This transfer-station ecosystem is far more resilient because it's divided into specialized roles—account brokers, SMS verification services, reverse engineers, resellers—each handling just one piece. Take down one operator and the rest survive, with replacements showing up within hours. This isn't an individual workaround anymore. It's become an industry.

There's a clear practical lesson for companies and dev teams here too. If you come across a reseller offering Claude API access well below list price, it's worth periodically checking whether the response quality still matches official benchmarks. As the CISPA study showed, requests can be quietly swapped to a different model without notice—and running a coding agent through a route like this risks exposing your entire internal codebase. It's safer to assume that a cheap price usually comes with a hidden cost.

Going forward, Anthropic will likely put more weight on behavior-based detection systems like Clio than on sign-up-stage KYC, since this analysis confirms that IDs and selfies can already be defeated with deepfakes and stand-in verification. Meanwhile, the debate over regulating distillation will probably drag on without a clear resolution. With 25 companies already on record opposing regulation, the US government seems more likely to narrow these workarounds under the banner of cybersecurity or export controls than to act against distillation directly.