The AI Credit Resale Economy
TL;DR Highlight
Following token brokers showed discounted AI access has unverifiable origins and terms
Who Should Read
Startup backend developers weighing discounted LLM API credits or relay endpoints to cut costs
Core Mechanics
- Brokers sell through three channels
- These are direct outreach, credit marketplaces, and their own API endpoints.
- The pitches look alike, but buyers get very different things.
- One seller offered $100,000 in spend per day
- The authors emailed sellers as prospective buyers using contacts from founders.
- One replied and made this offer in a private messaging app.
- Sellers proxy requests instead of handing over keys
- The authors say they likely pick from a pool of keys and forward requests.
- The article words this as "probably".
- Marketplace claims contradict each other
- AICreditMart's homepage advertises escrow-protected transfers.
- Its terms say it holds no escrow and guarantees no credit validity.
- CheapCredits advertises a flat 40% off list for every model
Community Reactions
- Opinion that sellers may deliver a different model
- Comments said discounts up to 98% suggest stolen keys, stolen cards, or auto-created trial accounts.
- One comment suspected buying Anthropic tokens might return Deepseek responses.
- Opinion that a middle proxy is a security risk
- A comment noted TLS terminates at the relay, so there is no end-to-end integrity.
- It said tool calls like bash can be tampered with and secrets exfiltrated.
- Opinion that traffic collection may be the goal
- Several comments said a man-in-the-middle gets real usage data for training or distillation.
- Others asked for evidence of fraud and said it may simply be a resale market.
- Comment asking how to verify the model you get
- One asked how to verify the purchased model is the one delivered.
- Another said trusting a reputation-less third party invites a breach.
How to Apply
- Check that your API base URL is official
- Grep code, env vars, and configs today for base URLs and key sources.
- Verify the source and contract for any non-official relay.
- Require approval for tool execution when using relays
- Turn on user confirmation so agents don't auto-run tool calls like bash.
- Assume relay responses can be tampered with.
- Run a checklist before buying discounted credits
- Ask the seller whether it's a balance, an account, or access via their endpoint.
- Get in writing who processes requests and what happens on suspension.
Try It
# Prompt to paste into Claude or ChatGPT (the article's buyer questions turned into a checklist)
You are a security reviewer. Below is a discounted AI API offer we are evaluating.
{{offer text}}
In a table, separate what the offer confirms from what it doesn't for these questions.
1. Is it a transferable balance, an account, or access through someone else's endpoint
2. What restrictions apply
3. Who processes the requests
4. What happens if the upstream account is suspended or capacity disappears
Don't guess; write 'unverified' for anything not in the offer.
Next: ask it to turn the unverified items into questions to email the seller.Terminology
Related Papers
Mercury 3: Diffusion at scale
Scaling diffusion LLM 40x gives Mercury 3: 4–8x faster than speed-tier models, similar quality
Timestral: Mistral's time-series foundation models
A 209M time-series model ranks first on three benchmarks and runs on CPU.
DeepSeek V4.1 Flash 1017 (Max)
DeepSeek V4.1 Flash 1017 Max scores 45 on the Intelligence Index at 211 tok/s and $0.30 input.
If you don't run your own LLM proxy, how do you know whats going on?
Running your own LLM proxy shows which keys, models, and cache misses drive your usage.
DeepSeek: DeepSeek v4.1 Flash 1017
DeepSeek V4.1 Flash 1017: $0.05/M input, 1M context, built for agents
DeepSeek-v4.1-Flash-1017
DeepSeek V4.1 Flash minor update lifts coding and agent benchmarks while cutting run time and output length
Show HN: Llmspeed – feel how fast a local LLM runs before you buy the hardware