Relay Stations · Cyber Smuggling?

Over the past ten episodes I’ve talked about AI constantly. With every technical shift, I’d comment on different models or their applications.

Sometimes I’d say the foreign models were better — because Fable or Opus 4.8 genuinely were quite good at the time — and the comment section would accuse me of worshipping everything foreign, telling me I didn’t understand that what Chinese people need is DeepSeek. Sometimes I’d say Doubao was good, and someone would demand: “I find it hard to believe you’re a serious investor. Please go eat some finer grain.” When I raised doubts about Qwen or Tongyi, others would show up asking: why don’t I support China’s domestic models? Why don’t I like China’s big tech companies? Why am I biased against Alibaba?

So no matter whom I praised or criticized, controversy seemed to follow.

Most of these hate comments I could understand. Only one truly stopped me in my tracks and made me look very carefully.

They said I was “running a relay-station business.”

At the time I didn’t really know what a relay station was. Honestly, to this day I have never used one — I’ve always connected directly myself.

But when people accused me of selling relay-station access, I got curious and looked into it. That’s when I realized that the spam ads that kept appearing under my videos were mostly posted by relay-station operators, trying to skim traffic off my videos, plastering ads like graffiti on a wall.

But you know, a small creator like me wants engagement numbers. If someone leaves a comment like that, I’m not going to casually delete it — think about it, I might have two comments total; delete the “graffiti” and I’m down to one, which is basically a 50% crash in my engagement rate. Obviously I can’t accept that.

So I left all their comments up. Word got around that this creator doesn’t delete comments, and the relay-station ads multiplied. I didn’t mind — it’s all comments, all engagement.

Until one day, a station operator added me on WeChat and said he wanted to buy an ad from me.

Oh, now this was getting interesting.

What follows is not his ad. It’s what he told me.

Supply: 80–90% comes from “account pools”

Let’s break this business down first.

Normally, to use the Claude API or its subscription plans, you register on the official site and need an international credit card that clears risk control, with a matching billing address. So for a while now, many people have had trouble accessing the service at all.

What does a relay station do? It inserts a layer between you and the official provider: you pay the operator, he gives you a key, your requests go to his server first, and he forwards them to the official API.

Technically there’s nothing mysterious about it. Most of the industry runs the same open-source software — essentially a cash register plus a router, settling in the middle at a multiplier. Which is where it gets interesting.

I asked him where his supply came from. He said 80% to 90% is “account pools,” and the rest, in his words, “depends on fate” — whether he can get hold of a large official key.

(An account pool is a pile of purchased subscription accounts bundled together; incoming requests are rotated across them.)

At first I didn’t understand why. I knew that in the US, some official channels offer much larger volume — Anthropic, for example, gives certain companies and educational institutions preferential deals: buy 100 million tokens and get 200 million, or pay 50 million for 100 million, effectively half price for specific companies or channels. In theory the official channel is bigger, more stable, and cleaner.

When I asked why official supply was only a rounding error for him, his explanation was very clear:

People with excess official quota will give you 50% off at best, even with a good relationship. Say those 100 million tokens sold at 50 million — if you’re close to the channel, maybe they resell to you at 25 million. Everyone’s happy, but at 50% off, a relay station doesn’t make nearly enough. Relay stations chase 10% of list price, or even below 1% — and prices like that essentially never leak out of official channels. So technical means become inevitable.

Then I understood. The gross-margin structure and the market structure of this business have completely priced legitimate sourcing out. Relay stations aren’t casually choosing to operate in a gray zone — the structure forces them into it. The official quotas I had imagined weren’t so much a source of supply as a stroke of luck.

Data: of ten thousand stations, maybe a thousand are selling

The second issue is data retention, and he didn’t hide it. Once your inputs and outputs pass through his server, the data is simply there. Whether it gets sold, he said, mostly comes down to conscience.

I asked several specific questions.

How many relay stations are there in China? His figure: close to ten thousand — if not just under ten thousand, then many thousands. As for those selling data — genuinely likely to sell user data — he estimated close to 10%, so around a thousand. In his words, the barrier to entry is very low, the industry is saturated, professional ethics vary wildly, and wherever there’s money to be made, someone will sell.

Someone once commissioned data from him. Here’s the core detail: a buyer approached him asking for conversation data from American women aged forty-five to fifty-five. He said he couldn’t provide it.

I was fairly shocked. I’d heard an urban legend about model companies buying this kind of data; but when a request that specific lands on an actual relay station, it’s a different matter.

I was curious how a relay operator could know users’ gender and age. He said it’s inference: users’ work habits and life details all sit on the server, and from their typical questions you can roughly reconstruct who they are. These deals are never done under real names, and they all go through Telegram.

What I’d learned from my own earlier research diverges somewhat from his account. Studies from Oxford’s China Policy Lab and Germany’s CISPA both concluded that many relay stations’ rock-bottom prices are simply bait — intercepting conversations and packaging them as training data is the real business. There are also reports that datasets of Claude outputs of unclear provenance have started circulating on some foreign sites.

My read is that his 10% (roughly a thousand stations) may only count those openly pricing and selling data outright, while the academic studies may also count those keeping the data for their own use. After all, once inputs and outputs pass through a relay server, the risk of misappropriation or resale is structural — outright sale is no surprise at all.

That 10% is his personal estimate, not rigorous industry statistics — nobody knows whether the real number is 10% or 90%. But one thing must be stated plainly: data resale is not an isolated incident.

Model swapping: he says it’s rare; the test data disagrees

The third issue is the most widely circulated accusation against relay stations — model swapping.

That is: you think you’re using Opus, or Fable, but the backend is running a model ten times cheaper, and the interface shows you nothing.

I asked whether adulterating models was widespread. Surprisingly, he said not really. Costs aren’t actually that high anymore — with account pools as supply, the cost base is fairly low; and if you dilute with other models to squeeze out extra profit, your reputation is destroyed the moment you’re caught and your customers evaporate. Operators playing the long game mostly don’t do it.

Note, though: this conversation happened while this relay-station friend was asking me to run his ads, so his defense inevitably leans toward his commercial position. Take it with a grain of salt.

The research I’d previously found says otherwise: someone tested relay stations — seventeen in the sample — and 46% of them had model fingerprints that didn’t match, i.e., the model had been swapped. Andrew Ng’s former team also ran a test: a station claiming to serve Gemini 2.5 scored 37 on a medical benchmark where the official model scores 84.

So although my contact felt dilution wasn’t common, in practice most people seem to believe it happens all the time.

You might think he was simply defending his trade. But what he said next, I found genuinely interesting.

He said there’s a truly nasty corner of this business. Say you bought his token service at a 1.x multiplier — the multiplier can be changed at any time. You keep using the service, and at some point you discover he’s turned the multiplier up ten-fold or a hundred-fold, and your balance has shriveled to a tenth or less.

This happens completely silently. You have no visibility into any of it.

The multiplier: harder to detect than a swapped model

I didn’t understand what the multiplier was, so I pressed him.

The multiplier means: for every 1 US dollar of official list price, how many yuan you pay him.

At a multiplier of 1, one dollar of official usage costs you 1 yuan. If a dollar is otherwise 7 yuan, your actual spend is one-seventh of official. So the formula is:

(1 ÷ 7) × multiplier ≈ your effective discount

At a multiplier of 1 that’s about 0.145 — call it 14.5% of list: for every 1 yuan spent on the official side, you pay 14.5 fen.

Here’s the interesting part: if he turns the multiplier to 10, the same usage costs you 10 yuan; at 100, you pay 100 yuan — while the official side still only collects 7. Your balance can be drained in a stroke.

With a swapped model, you at least have a chance to notice something’s off and run checks. A multiplier change just takes your money directly — the only thing you might notice is that this month’s balance is burning faster than last month’s. You’ll assume you used more, never knowing he took the money by other means.

So multiplier manipulation is far harder to detect than model swapping. A truly rational operator might well leave the model alone and adjust the multiplier instead.

I’m actually not fully sure my understanding here is correct, since I’ve never used a relay station. If any reader knows this better, corrections welcome in the comments.

Customers: 20–30k a deal, three people, 300k monthly profit

Later I asked where his customers were. Mainly domestic B2B, he said.

For example, he’d come to Shanghai for a conference and drop in on ChinaJoy game studios one by one, signing deals of twenty to thirty thousand yuan a month in usage — trial first, then see whether bigger cooperation follows. If the client finds the relay stable and usable, they may stay long term.

His previous company ran roughly like this: monthly revenue around 700,000 yuan, monthly profit around 300,000, a net margin north of 40% — with a team of three.

Do the math: at 20–30k per customer, 700k monthly revenue is only twenty to thirty clients. That can’t be consumers; it has to be small businesses. An individual user struggles to spend even a few hundred yuan a month, but a small business burning tens of thousands a month makes the company viable quickly.

Which is also roughly why he wanted to advertise with me: he figured my audience contains a lot of people running AI startups, who would have much stronger demand for this.

As for his cost structure, most of it is the account pool. He said pool costs keep rolling and churning — it’s not a one-off investment: accounts get banned and must be replenished; IPs get flagged and must be rotated. It’s an asset on the balance sheet that burns itself down a little every day — stop feeding it money and it gets thinner by the day. It’s a maintenance expense that never stops.

The ceiling: top players clear five million a month

Next question: the ceiling.

I asked him, “This business looks pretty good — how big can it get?” The industry ceiling, in other words. I asked who China’s largest relay station was; he wouldn’t say — I don’t know whether he actually knows — but he gave a scale: he believes the top relay stations make upwards of five million yuan a month in profit (that was an older figure; presumably it’s more now).

Meaning the top of the market is roughly ten times bigger than the guy I know.

If monthly profit exceeds five million yuan, monthly revenue must be north of ten million.

I later checked this against public reporting: 36Kr’s survey in June this year also put top-tier stations at eight-figure monthly revenue with teams under 20 people. The man I interviewed runs a team of three, so his smaller scale makes sense.

Cat and mouse

Everyone knows Anthropic’s recent account bans have been sweeping — it’s been discussed to death, so I’ll skip it.

He offered some rather interesting workarounds. There are plenty of solutions, he said, but they all eat into profit.

For instance, there are groups known as “technical assault teams” — station operators scattered across the country, nominally competitors, forming alliances to reverse-engineer the provider’s risk-control logic through counter-surveillance and counter-investigation.

He added one more thing — this is his speculation only, with no evidence, and I have no way to verify it — he claimed there’s a mole inside Claude Code leaking the vulnerabilities. I was somewhat taken aback hearing that.

According to reporting on Anthropic from this January, it banned 1.45 million accounts in half a year. 52,000 appealed, and only 1,700 were reinstated — a 3.3% success rate. The common industry explanation is that over 70% of bans stem from contaminated data-center IPs. Last year, for example, bans hit companies with majority Chinese ownership — risk control pierces through Singaporean and American overseas entities, tracing IPs to their true owners.

He didn’t sound like he had a clear long-term plan. But he claimed he could steer clear of legal risk, or at least considered the legal risk manageable, and shared some specific evasion methods, which I won’t expand on here.

I certainly won’t repeat what he told me, but I did come away with one conclusion: Chinese people are astonishingly clever. Open-minded, genuinely a very smart nation. But being Chinese, the competition is truly brutal.

The ad: why he came to me

Back to the beginning — why did he add me and tell me all this?

He was hoping I could funnel some traffic to him through my videos’ comment sections, in an ad-placement-like arrangement. In his own words:

“Relay stations aren’t really something you can put on the table and promote openly, so distribution usually happens through this kind of viral, graffiti-style advertising.”

According to him, this graffiti advertising actually performs rather well.

Which also explains why so many of my videos have had spam ads underneath — and not just relay stations; plenty of AI apps funnel traffic to themselves in my comment sections too. Interesting in its own way.

Why Anthropic hates relay stations so much

From Anthropic’s perspective, there are a few main reasons they hate relay stations.

First, from their standpoint, they don’t want Chinese users on any Anthropic service. On the surface that may be a slogan they consider righteous; I won’t dwell on it — Anthropic’s string of actions speaks for itself.

Second, many relay stations run on account pools plus the subscription model. Subscriptions are already the lower-margin business for frontier labs — selling API access carries better margins. And now this lower-margin business has people maxing out subscription quotas via account pools, selling every last token.

It’s like a gym that priced membership assuming one in ten members shows up — except all ten show up, plus two gate-crashers, so ten people’s fees cover twelve people’s usage. Naturally the operator is miserable.

Third — and this is what frontier labs fear most — distillation. Distillation is a neutral term here; we’ve covered it many times on this show, so I won’t rehash it. But to model companies it’s the other grave problem — which is why I asked him point-blank who was buying the data: user prompts, model outputs, and especially reasoning chains get intercepted, packaged, and sold to train other models.

It’s copying homework with someone else’s most expensive, most precious data. The good student has the best stationery and the best grades; the struggling student starts by copying the good student’s homework. That’s roughly the metaphor.

One more thing — this guy was genuinely interesting.

He believes tokens are still in their infancy; only once they seep into every corner of life will people grasp their staying power. If they end up powering embodied intelligence or other compute-hungry frontiers, everyone will come to treat them as oil and currency.

So he positions himself as something like a gray-zone “shadow fleet.”

Like Russia or Iran: when oil can’t be exported normally, shadow fleets carry it to third countries (Malaysia especially), transfer it ship-to-ship to another company, and sell it onward. Oil smuggling is itself a very large business.

Picture it: a former game developer, running open-source cash-register software on an offshore server, splitting America’s most expensive intelligence into 14-fen portions and selling them to Chinese users and game studios. It’s quite a scene.

I found his framing genuinely compelling. When we don’t yet know whether to define a thing as oil, currency, or electricity, the first people to truly understand it — the ones who grasp the frontier — are usually not the research analysts writing investment-bank reports, but the smugglers. They have superhuman sensitivity, and they understand it before anyone else.

If you're working on this too — or you think we've got it wrong — write to us at [email protected]; if you'd rather not write, just leave your email below.