China's Grey Market for Claude Tokens: How Developers Access Cheap AI at a Hidden Cost

Introduction

In China, accessing Anthropic's Claude is technically impossible through official channels. Anthropic geoblocks Chinese users, requires overseas credit cards, and has recently added biometric KYC verification. Yet millions of Chinese developers, students, and "vibecoding" enthusiasts use Claude every day — often at prices as low as 10% of what Western users pay.

How? Through a sprawling grey market of API proxies called transfer stations (中转站).

A recent investigation by Zilan Qian at the Oxford China Policy Lab, published by ChinaTalk, pulls back the curtain on this ecosystem — and what it reveals is far more troubling than a simple arbitrage play.

What Is a Transfer Station?

A transfer station is an overseas server — often hosted in Singapore — that acts as a middleman between a Chinese developer and Anthropic's infrastructure. The user sends their API request to the proxy, which forwards it to Anthropic as if it originated from an approved location, then passes the response back.

The result: no VPN needed, no overseas credit card, no Anthropic account. Just pay in RMB via WeChat or Alipay, configure your ANTHROPIC_BASE_URL environment variable to point at the proxy, and you're in.

These services operate completely in the open — listed on Taobao, Telegram, WeChat groups, GitHub repositories, and price-comparison sites like aiapipk.com. Developer forums like V2EX host daily threads ranking transfer stations by price, uptime, and reliability.

The "One Fish, Three Meals" Business Model

How can these operators offer Claude tokens at 70–90% discounts and still turn a profit? The answer lies in three stacked revenue streams — what the ChinaTalk piece calls the "one fish, three meals" model.

Meal 1: Markup on Stolen or Farmed Tokens

Operators acquire tokens at near-zero cost through:

• Stolen credit cards used to bulk-purchase API credits
• Account farming — mass-registering for free $5 Anthropic credits across thousands of accounts
• Subscription splitting — carving up a single $200 "Max" plan among dozens of users, exploiting the gap between flat subscription pricing and pay-per-token API costs
• Corporate and educational discounts resold to retail users

They then resell these tokens at a markup — still far below official prices, but profitable given their near-zero acquisition cost.

Meal 2: Model Substitution Fraud

Users who pay for Claude Opus often receive responses from much cheaper models — Claude Sonnet, Haiku, or even domestic Chinese alternatives like Qwen or GLM — relabeled as Opus.

The ChinaTalk investigation includes a striking data point: a proxy marketing itself as "Gemini 2.5" scored just 37% on a medical benchmark where the official Gemini 2.5 API scored 83.82%. Users are paying premium prices for budget-tier outputs, with no way to verify what model actually processed their request.

Meal 3: Prompt Harvesting (The Real Product)

This is where the business model turns genuinely alarming. Every request routed through a transfer station — every prompt, every response, every reasoning chain — is logged on the operator's servers.

This data is then:

• Used to train supervised fine-tuning pipelines
• Used to distill reasoning patterns from frontier models into cheaper domestic alternatives
• Sold to AI competitors as training data

In other words, users aren't just customers. They are unpaid data producers. The cheap tokens are the bait; the harvested intellectual property is the real product.

Developers feeding proprietary code, business logic, customer data, or sensitive research through these proxies are unknowingly donating it to competitors.

Bypassing Anthropic's Safety Measures

Anthropic has progressively tightened access controls — phone verification, overseas-card mandates, and as of April 2026, biometric KYC including iris scans. None of it has stopped the transfer station ecosystem.

The ChinaTalk piece reports that biometric verification requirements are being circumvented by recruiting real people in lower-income countries to complete the checks — with iris scans reportedly sold for less than $30.

The grey market has, in effect, industrialized the circumvention of every safety measure Anthropic has deployed.

Legal Status and Regulatory Risk

Transfer stations are technically illegal in China. Under China's AI regulations, any AI service operating in China must complete a filing and security assessment with the Cyberspace Administration of China (CAC). Transfer stations, by definition, skip this process entirely.

Yet enforcement has been minimal. The services operate openly on mainstream Chinese e-commerce and social platforms, suggesting either regulatory tolerance or an enforcement gap that operators are happy to exploit.

Why This Matters Beyond China

The transfer station phenomenon is more than a China-specific curiosity. It surfaces several broader issues that the global AI industry will need to grapple with:

1. Model integrity is unverifiable at scale. When users can't confirm which model processed their request, benchmarks and capability claims become meaningless in practice. The 37% vs. 83.82% benchmark gap is a preview of what happens when model identity is spoofed at scale.

2. Data security assumptions break down. Enterprise and developer users increasingly assume that API calls to frontier models are private. Transfer stations demonstrate that this assumption is fragile — and that the attack surface isn't just Anthropic's infrastructure, but every intermediary in the supply chain.

3. Geoblocking creates grey markets, not barriers. Anthropic's decision to block Chinese users didn't prevent Chinese access to Claude — it just routed that access through criminal intermediaries who harvest data and undermine safety controls. This is a lesson with implications for any technology company considering geographic restrictions.

4. The economics of AI access create structural incentives for arbitrage. When the gap between official pricing and what users can afford is large enough, grey markets will emerge. The transfer station ecosystem is a direct consequence of that gap.

Key Takeaways

• Transfer stations are overseas API proxies that sell Claude tokens to Chinese users at 70–90% discounts, operating openly on Taobao, Telegram, and GitHub.
• Their business model has three layers: cheap/stolen token resale, model substitution fraud, and prompt harvesting — with data collection being the most valuable revenue stream.
• Every prompt sent through a transfer station should be assumed to be logged, stored, and sold.
• Anthropic's KYC and biometric verification measures have been circumvented through human recruitment in lower-income countries.
• The ecosystem is technically illegal in China but operates with minimal enforcement.
• The broader lesson: geoblocking frontier AI creates grey markets that are worse for safety and data security than regulated access would be.

Sources

• Zilan Qian, "How to Buy Cheap Claude Tokens in China," ChinaTalk (Oxford China Policy Lab), 2025. chinatalk.media