A research associate at the Oxford China Policy Lab has documented how Chinese developers buy access to Anthropic's Claude models at as little as 10% of the official price. Zilan Qian published the investigation on ChinaTalk in early May, mapping a grey economy of API proxies that Chinese developers call transfer stations (中转站).
How the cheap tokens actually work
The short version: a transfer station is an overseas server that sits between a developer and Anthropic's infrastructure. It takes your API request, forwards it as if it came from somewhere Anthropic actually serves, and hands the response back. You point your software at the proxy instead of Anthropic, and you pay in RMB through WeChat or Alipay. No VPN, no foreign credit card, no billing address that has to match.
Qian frames the economics with a Chinese cooking metaphor, one fish, three meals (一鱼三吃). The first meal is the boring one: markup on access. Operators bulk-register accounts to farm Anthropic's $5 free credit, resell unused quota, and carve a single $200 Max plan into pieces for dozens of users through hourly token limits. Some accounts are bought with stolen cards, which means they cost the operator nothing. How big that fraud slice is, nobody can say with confidence, and Qian doesn't pretend otherwise.
The second meal is where it gets dishonest
Because everything routes through a middleman, you cannot actually verify which model answered your request. You pick Opus 4.7. The proxy quietly sends it to Sonnet, Haiku, or a domestic model like Qwen or GLM, then relabels the output. You only notice when the answer feels off on a hard task, what Chinese developers call 降智, or dumbed-down. Proving it is another matter.
There's data on this. A recent paper from Germany's CISPA Helmholtz Center audited 17 API proxies and found model swapping all over the place. Proxy access labeled Gemini-2.5 scored 37% on a medical benchmark against 83.82% for the official API. That second decimal place is doing a lot of suspiciously precise work, but the gap itself is the point.
Your logs are the actual product
The third meal is the one that matters. Every prompt, every response, every tool call and reasoning chain passes through the operator's server and sits there. For coding agents, those logs hold real engineering decisions and human-verified correct outputs, which is close to ideal training data for fine-tuning or distilling Claude's reasoning into a smaller model.
Qian is careful here, and that caution is worth flagging. Chinese developer communities claim log harvesting is happening. Whether operators systematically collect and sell these logs, and to whom, stays unverified. What is verifiable: datasets of Opus reasoning outputs already circulate on Hugging Face with no clear source. Several developers Qian cites argue the markup is just customer acquisition. The log harvest is the real margin. You're a paying customer and an unpaid data supplier at the same time.
Why this outruns Anthropic's defenses
Anthropic has stacked controls: phone numbers, overseas cards, matching billing addresses. In September 2025 it closed the subsidiary loophole that let Chinese-backed firms abroad keep access. In April it began requiring some users to verify with a government ID and a live selfie.
Each layer just spawns a matching layer of evasion. SMS farms supply foreign numbers. Agents recruit real people in lower-income countries to pass in-person checks, an echo of the documented Worldcoin iris-scan black market. The supply chain is modular, so Anthropic can ban an operator and the upstream account pools and downstream buyers survive intact. A replacement goes up within hours.
The framing this contradicts is the official one. On April 23, the White House released a memo about industrial-scale distillation campaigns run by Chinese entities. In February, Anthropic reported a single proxy network managing more than 20,000 fraudulent accounts. Both treat the proxy as a deliberate weapon built by a few frontier labs. Qian's argument is that underneath those labs sits a vastly larger market of professors, students, and hobbyists who just want cheaper tokens, and that the official story misreads it.
Anthropic's next move is more verification, the selfie-and-ID check being the current one. Qian's research suggests that won't be the last word, and that the next layer of workarounds is probably already being built.
