Tekin Analysis: The Dark Token Market & LLM API Proxy Theft

The Black Market Threatening the AI Industry

While major AI companies release increasingly powerful models and raise API prices, a parallel ecosystem has emerged in the shadows offering access to these same models at dramatic discounts. This black market - concentrated primarily in China - doesn't just circumvent geographic access restrictions; it has become a tool for data theft, training competitor models, and even financial fraud.

On February 23, 2026, Anthropic - the maker of Claude - dropped a bombshell that sent shockwaves through the AI industry. The company formally accused three Chinese firms of running "industrial-scale campaigns" to illegally extract Claude's capabilities. DeepSeek, Moonshot AI, and MiniMax - three giants of China's AI industry - had conducted over 16 million exchanges through 24,000 fraudulent accounts. This marked the first time an American company had accused Chinese firms of technology theft with this level of specificity and technical evidence.

But Anthropic's accusations were just the tip of the iceberg. Broader research published by ChinaTalk revealed that these three companies are merely players in a much larger network. A complete marketplace exists with complex infrastructure, open-source software, payment networks, and even customer support services whose sole purpose is selling unauthorized access to frontier models.

Market Structure: How This Ecosystem Works

The LLM dark token market is a complex supply chain involving multiple actors. At the top level are "Account Farms" - operations that create AI accounts at scale. These farms use "verification platforms" that supply phone numbers to pass signup checks, and "identity brokers" who fabricate credentials.

In the middle of this chain sit proxy servers - the beating heart of the system. These proxies receive API requests from developers and relay them to API providers via accounts that appear legitimate but may not be. The primary software used for these proxies is `one-api` and its more actively developed fork `new-api` - both open-source, legitimate products designed for load balancing but heavily adopted by black market operators.

Three Revenue Models for Proxy Operators

Proxy operators use three main methods to generate revenue, often applied simultaneously. The first is "price arbitrage." They farm free trial accounts, resell educational and startup quotas, exploit regional discount programs, and split paid subscriptions among multiple users. This sources tokens below cost, which are then marked up for resale.

The second method - and perhaps even more profitable - is "Model Swapping." A customer pays for Claude Opus 4.7 but receives Haiku or an open-weight model like Qwen. The proxy pockets the cost difference. This happens in nearly half of all requests across the 17 shadow APIs that CISPA Helmholtz Center tested. On medical benchmarks, accuracy dropped from 83.82% (official Gemini 2.5 Flash) to around 37% through shadow APIs.

The third revenue stream - and where the real money is - is "Log Harvesting." Every prompt and response passing through the proxy is logged on the operator's server. This corpus has two downstream uses: first, lead generation for targeted fraud (financial details, business logic, personal data from prompts). Second, training data for model distillation.

Distillation: A Legitimate Technique Weaponized

Distillation is a standard machine learning technique where a smaller model is trained to mimic a larger one's behavior. Labs routinely do this with their own models - for example, OpenAI uses GPT-4 to train GPT-4-mini. But the concern here is the data source. When proxy operators harvest reasoning traces from thousands of unsuspecting users and publish them as training datasets, the resulting "distilled" models are built on stolen outputs.

On Hugging Face, the indicator isn't the word "distilled" alone. The red flag is a model trained on proprietary closed-model outputs (Claude, GPT) where the uploader has no institutional affiliation, no disclosed API budget, and no clear explanation for how they generated that volume of data through legitimate means. Multiple Claude reasoning-trace datasets that appear to originate from proxy logs have surfaced on Hugging Face, used for fine-tuning open-weight models.

Anthropic's Accusations: Three Industrial Campaigns Exposed

In its February 23, 2026 statement, Anthropic disclosed technical details of three distillation campaigns it attributed to DeepSeek, Moonshot AI, and MiniMax. Each campaign followed a similar playbook: using fraudulent accounts and proxy services to access Claude at scale while evading detection. Anthropic attributed each campaign to a specific lab with high confidence through IP address correlation, request metadata, infrastructure indicators, and in some cases corroboration from industry partners who observed the same actors and behaviors on their platforms.

DeepSeek: Industrial-Scale Chain-of-Thought Extraction

DeepSeek's campaign involved over 150,000 exchanges targeting reasoning capabilities across diverse tasks, rubric-based grading tasks that made Claude function as a reward model for reinforcement learning, and creating censorship-safe alternatives to politically sensitive queries. DeepSeek generated synchronized traffic across accounts - identical patterns, shared payment methods, and coordinated timing suggesting "load balancing" to increase throughput, improve reliability, and avoid detection.

In one notable technique, their prompts asked Claude to imagine and articulate the internal reasoning behind a completed response and write it out step by step - effectively generating chain-of-thought training data at scale. Tasks were also observed where Claude was used to generate censorship-safe alternatives to politically sensitive queries like questions about dissidents, party leaders, or authoritarianism - likely to train DeepSeek's own models to steer conversations away from censored topics.

Moonshot AI: Targeting Agent Development

Moonshot AI's campaign (maker of Kimi models) was the largest in terms of diversity. Over 3.4 million exchanges targeting agentic reasoning and tool use, coding and data analysis, computer-use agent development, and computer vision. Moonshot employed hundreds of fraudulent accounts spanning multiple access pathways. Varied account types made the campaign harder to detect as a coordinated operation.

Anthropic attributed the campaign through request metadata that matched public profiles of senior Moonshot staff. In a later phase, Moonshot used a more targeted approach, attempting to extract and reconstruct Claude's reasoning traces. This shows they weren't just collecting outputs but trying to reverse-engineer the model's thought process.

MiniMax: Detection Before Product Launch

MiniMax's campaign was the largest by volume - over 13 million exchanges targeting agentic coding, tool use, and orchestration. Anthropic attributed the campaign to MiniMax through request metadata and infrastructure indicators, confirming timings against their public product roadmap. Notably, Anthropic detected this campaign while still active - before MiniMax released the model it was training.

This gave Anthropic unprecedented visibility into the lifecycle of distillation attacks, from data generation through to model launch. When Anthropic released a new model during MiniMax's active campaign, they pivoted within 24 hours, redirecting nearly half their traffic to capture capabilities from the latest system. This shows how agile and responsive these campaigns are.

Hydra Infrastructure: Multi-Headed Proxy Architecture

For national security reasons, Anthropic does not currently offer commercial access to Claude in China or to subsidiaries of their companies located outside the country. To circumvent this, labs use commercial proxy services that resell access to Claude and other frontier AI models at scale. These services run what Anthropic calls "hydra cluster" architectures: sprawling networks of fraudulent accounts that distribute traffic across our API as well as third-party cloud platforms.

The breadth of these networks means there are no single points of failure. When one account is banned, a new one takes its place. In one case, a single proxy network managed more than 20,000 fraudulent accounts simultaneously, mixing distillation traffic with unrelated customer requests to make detection harder. This distributed architecture makes blocking these services extremely difficult.

GitHub Repositories: Open-Source Tools Serving the Black Market

The Weather Report identified eight public GitHub repositories that openly facilitate unauthorized API resale, with a combined ~172,000 stars. Two of them, CLIProxyAPI and claude-relay-service, were named by Mandiant as tools used by PRC-nexus actor UNC5673. CISPA found that 11 of the 17 shadow APIs they audited run on one-api or its fork new-api - two open-source API gateway frameworks that are dual-use but heavily adopted by proxy operators.

Most transactions happen off GitHub, of course. Payment flows through WeChat and Alipay, support runs in QQ groups, listings appear on Xianyu (Alibaba's secondhand marketplace), and contact details are published directly in repository READMEs. This is a complete marketplace with purchasing, sales, and support infrastructure - just for a product that shouldn't legally be sold in that region.

White House Response: National Security Threat Confirmed

In April 2026, the White House responded with a memorandum acknowledging industrial-scale distillation as an adversarial threat. The document affirmed the Trump administration's commitment to working with the private sector to build defenses against industrial-scale distillation and hold foreign actors accountable for such campaigns. This marked the first time the U.S. government formally recognized unauthorized distillation as a national security issue.

This government response shows the issue has escalated beyond a simple commercial dispute between companies. When distilled models are built through illicit methods, they lack necessary safeguards - meaning dangerous capabilities can proliferate with many protections stripped out entirely. Foreign labs that distill American models can feed these unprotected capabilities into military, intelligence, and surveillance systems.

Who Is at Risk?

Direct risk applies to any organization or developer routing LLM API calls through a third-party provider that is not an official API partner. This includes teams using discount API brokers, startups cutting costs through reseller channels, and research groups accessing models through unofficial endpoints.

The user base spans university professors, students, tech workers, individual developers, and hobbyists. Risk is highest in regions where frontier models are geo-blocked (China, Iran, Russia), but extends globally wherever cost pressure pushes buyers toward cheaper alternatives. An indirect risk hits organizations whose employees or contractors use these proxies without central IT awareness.

Real Risks: What's at Stake?

Prompt logs harvested by proxy operators are a high-value asset with multiple uses. For fraud, they contain financial details, authentication patterns, personal information, and business logic that users disclosed in conversation with the model. For distillation, the reasoning traces from frontier models (especially Claude Opus chain-of-thought outputs) are exactly the training data needed to fine-tune cheaper open-weight models.

There's also the reliability risk which is immediate for organizations that unknowingly consume dark tokens through a supply chain. A model swap from Opus to Haiku or Qwen degrades your output quality silently. If your application depends on a specific model's reasoning capability (medical triage, code generation, legal analysis), a swap can produce subtly wrong outputs with no error signal.

The Breach You Never See

The dark token economy is unlikely to produce a single dramatic breach or security incident. Prompt data is leaking through thousands of small proxy operators simultaneously, and the downstream uses (fraud, distillation, targeted social engineering) are hard to trace back to the original exposure. An organization that routed API traffic through a proxy for six months may never learn that its internal documents ended up in a training dataset or that its customers' financial details were sold to a fraud ring.

The more pressing near-term risk is silent model degradation. Applications that depend on a specific model's reasoning quality can fail in subtle, hard-to-diagnose ways when the underlying model is swapped without notice. In high-stakes domains like medical triage, legal analysis, or financial modeling, those failures carry real consequences, and the absence of an error signal means they can persist for weeks or months before detection.

Defense Guide: How to Protect Yourself

If you're not in a geo-blocked region, you probably won't end up using a transfer station on purpose since you can have direct API access to any model you need. The more realistic ways this touches you are indirect: an offshore dev team quietly routing calls through a proxy, a startup picking a discount API broker without asking how the discount works, or a developer copying a cheap provider config from a side project into production.

The Role of AI Companies: What's Being Done

Anthropic and other frontier AI companies are actively investing in defenses that make distillation attacks harder to execute and easier to identify. Anthropic has built several classifiers and behavioral fingerprinting systems designed to identify distillation attack patterns in API traffic. This includes detection of chain-of-thought elicitation used to construct reasoning training data. They have also built detection tools for identifying coordinated activity across large numbers of accounts.

Intelligence sharing is also happening. Anthropic is sharing technical indicators with other AI labs, cloud providers, and relevant authorities. This provides a more holistic picture into the distillation landscape. Access controls have been strengthened: verification for educational accounts, security research programs, and startup organizations - the pathways most commonly exploited for setting up fraudulent accounts.

Ethical Debates: Legitimate Distillation vs. Theft

One of the most complex aspects of this saga is the ethical debates it has sparked. Some critics argued it was hypocritical for Anthropic to object to companies using its models' outputs for training, when AI developers commonly train models on copyrighted material, presuming that this activity is fair use. Others framed the accusations as an attempt by Anthropic to maintain its competitive advantage by encouraging tighter U.S. regulation of Chinese AI firms.

But there's an important distinction: distillation itself is a legitimate, accepted technique. All major AI companies use it. The problem is when distillation is conducted through fraudulent means - fake accounts, stolen identities, circumventing geographic restrictions, and explicit violation of terms of service. This is no longer a technical or ethical debate - it's a legal and national security issue.

The Future of the Black Market: Where Are We Heading?

The LLM dark token market is unlikely to disappear anytime soon. As long as a significant price spread exists between official APIs and the black market, the arbitrage opportunity remains for operators. And as frontier model prices increase, that spread grows larger. The Token Price Index shows that AI inference costs are rising - especially for top-tier models like GPT-4, Claude Opus, and Gemini Ultra.

The Shanghai operator arrest in early 2026 showed governments are starting to take this seriously. But one arrest in one city in China will have little impact on a global market that operates primarily online. The White House memorandum was an important step, but actual enforcement has yet to be seen. Will the U.S. impose targeted sanctions against specific Chinese companies? Will export controls expand to cover proxy software?

Ultimately, the long-term solution likely requires a combination of technical, legal, and policy measures. AI companies must build better defenses - strict caps for API keys, better detection of unusual patterns, and more cooperation on threat intelligence sharing. Governments must provide clear laws about what's legal and what's illegal, and enforce those laws. And the international community must agree on norms around responsible AI use.

Conclusion: A Multi-Layered Threat

The LLM dark token market is a multi-dimensional threat with security, economic, and geopolitical dimensions. For individual developers and startups, it's the danger of data exposure, quality degradation, and legal risks. For major AI companies, it's a threat to revenue, intellectual property, and control over who uses their technology. For governments, it's a national security threat - a way to circumvent export controls and proliferate AI capabilities without necessary safeguards.

Anthropic's February 2026 disclosure was a watershed moment. For the first time, an American company with documented technical evidence showed that industrial-scale distillation is a reality - not a conspiracy theory or industry rumor. 16 million exchanges from 24,000 fraudulent accounts represent just three companies. How many other companies are conducting similar operations that haven't been detected yet? How many innocent developers are unwittingly contributing to this system through a discount proxy?

The reality is that this market is by no means limited to China. The current focus on China is due to geographic restrictions that create more pressure for proxy solutions. But as API prices rise globally, the incentive to find cheaper access grows everywhere. Black markets thrive when the price spread between legal and illegal product is large enough. And with inference costs continuing to rise, that spread will only get larger.

The question isn't whether this market will continue - it's how large it will grow and what damage it will cause along the way. For organizations that act today, the risk is manageable. For those waiting until a breach happens, it may be too late - because with dark tokens, you might never know a breach occurred.