A gray market for Claude access has taken shape in China, despite Anthropic using some of the toughest access controls among major AI providers. The system gives developers a way to buy Claude tokens cheaply through overseas API proxies, while making it harder for Anthropic to see who is really using its models.
How transfer stations bypass access controls
According to an analysis by Zilan Qian, a researcher at the Oxford China Policy Lab, Chinese developers can buy Claude tokens for about 10 percent of the official price through services known in the Chinese developer community as "transfer stations." These services sit between the user and Anthropic.
The transfer station receives an API request, sends it onward through servers outside China, and returns the model response to the customer. From the user's side, the appeal is straightforward: payment can happen in Chinese yuan through WeChat or Alipay, and the user does not need a VPN or a foreign credit card.
Anthropic checks phone numbers, foreign credit cards, and billing addresses. It also bans companies that are more than 50 percent owned, directly or indirectly, by entities in unsupported regions like China. For select users, it requires identity verification using an ID and a live selfie.
The gray market works because it does not depend on one simple trick. It is a commercial layer built around those restrictions, with directories ranking popular transfer stations by price and availability.
A modular market is difficult to remove
Qian describes the transfer station as only one part of a wider supply chain. Upstream actors mass-register Anthropic accounts, SMS verification platforms provide foreign phone numbers, and reverse-engineering specialists study detection systems. Downstream actors include developers, companies, resellers, and sellers on Chinese e-commerce platforms like Taobao.
That structure matters because it makes enforcement harder. Most participants handle only one or two parts of the business. If one provider is banned, the customers and account sources can remain in place while a substitute appears within hours.
The customer base also appears broader than a narrow group of advanced AI labs. Qian says likely users include Chinese AI labs trying to distill Western models, but also students, researchers, developers, tech employees, companies, app makers, and hobbyists.
Distillation is the practice of using outputs from a stronger model to improve a weaker one faster. In this context, cheap and hard-to-trace access to Claude is not only a consumer workaround. It can also become part of a model-development pipeline.
Why the prices can fall so far
The analysis lays out several ways operators can offer access 70 to 90 percent below list price. Some farm Anthropic's free $5 credit. Others exploit enterprise and education discounts, or divide a single $200 Max plan among multiple users through token quotas.
Accounts funded by stolen or fraudulently used credit cards may also enter the system, although the analysis does not establish how large that share is. The point is that the market can combine legitimate discounts, account abuse, and payment fraud without every customer seeing how the access was obtained.
There is also a product-quality problem. Because the proxy controls the middle of the transaction, it can reroute a request intended for a more expensive model to a cheaper one. A user may believe they are paying for Opus 4.7 while receiving Sonnet or even a Chinese model like Qwen.
Researchers at Germany's CISPA Helmholtz Center for Information Security examined 17 API proxies and found widespread model swapping, according to Qian. One endpoint presented as "Gemini-2.5" scored 37 percent on a medical benchmark, compared with the official 83.82 percent. The Chinese community calls this practice "diluting."
The hidden value may be in the logs
Qian argues that usage data may be one of the biggest economic levers behind the market. A proxy operator can potentially see prompts, responses, tool calls, and iterations. When coding agents are involved, the exposed context can include information about a codebase and workflow.
That data could be valuable for training or distillation. Datasets containing Claude Opus 4.6 reasoning outputs with unclear provenance are already circulating on HuggingFace. Chinese developers warn, according to the analysis, that token access may function as customer acquisition, while the real margin comes from logs.
Qian is careful about the limits of the evidence. She says there is no proof yet that transfer station operators are systematically collecting and selling this data, or who any buyers might be. Her argument is narrower but important: extremely low prices become easier to explain if usage logs can be monetized in addition to token sales.
Why this is bigger than geoblocking
The same infrastructure that helps a geoblocked developer reach Claude could also help a malicious actor reach frontier models without being directly visible to the provider. When traffic comes through a proxy, Anthropic initially sees the proxy account and IP address, not the end user.
That can weaken monitoring tools such as Clio, which are meant to detect coordinated abuse across accounts and conversations. If activity is spread across many proxy accounts and broken into individually inconspicuous sub-requests, patterns become harder to connect.
The circumvention market may also feed criminal activity outside AI. Qian says biometric data gathered for KYC workarounds could be resold for financial fraud or deepfakes. Account farming can support spam, phishing, and credit card fraud.
The problem has already touched the business interests of major AI providers. Anthropic had uncovered large-scale distillation attacks by Deepseek, Moonshot, and MiniMax, involving more than 24,000 fake accounts and over 16 million requests. Anthropic, OpenAI, and Google recently began working together against unauthorized model copying by Chinese competitors.
Anthropic also cut off services to firms under Chinese control and closed the subsidiary loophole. Alibaba banned employees from using Claude Code after hidden code was found that could identify Chinese users.
The result is a difficult policy and security tradeoff. Stronger access controls can block some unauthorized use, but they can also create profitable markets for circumvention. In China’s Claude token market, that means cheaper access for ordinary users, weaker visibility for providers, and a wider ecosystem built around identities, accounts, payments, and data.