Build1 distinct publisher3 min readUpdated
Zilan Qian's analysis says Chinese buyers get Claude for about a tenth of list through overseas proxies that quietly substitute cheaper models. Provider region checks are a billing control, not a security one.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
Farming free credits does not pay for this on its own. Anthropic's $5 signup credit [11], resold at a tenth of list [1], grosses fifty cents; an operator would need roughly 400 registered accounts to gross $200 [1]. Registration is not free labour either, since each account needs a foreign phone number bought from an SMS verification platform [7]. The margin has to come from the other levers Qian lists: enterprise and education discounts, and a single $200 Max plan sliced across many users by token quota [11]. And from cards that were not the buyer's, whose share of the account pool the analysis cannot size [12].
Model swapping is the part that should interest anyone building on resold access. Because the station sits between the client and the API, it decides which model answers [2], and operators substitute cheaper models for expensive ones without telling the buyer [5]. Someone paying ten percent of list [1] for what is sold as a frontier model has no way to verify what produced the tokens. That includes the buyers Qian believes are distilling Western outputs to improve weaker models [13]. A distillation run bought through a station is trained on whatever the operator's routing policy picked that day, not on the model named in the listing.
Look at where Anthropic's controls actually sit. Phone numbers, foreign credit cards, billing addresses, majority-ownership screening, and an ID plus live selfie for selected users [4] all cluster at the moment an account is opened, and account brokers have industrialised exactly that moment [7]. None of it observes the person running inference, because that person never holds an account. Verification of this kind establishes who can be billed.
Qian is careful about her evidence, and the read should be too: parts of the account rest on informal conversations and publicly available sources [15]. The KYC bypasses she describes cover generated IDs, deepfaked liveness checks, and recruited people in low-income countries [9], but without a price attached to Claude-specific verification. The nearest hard figure is her Worldcoin comparison, where iris scans from Cambodia and Kenya changed hands for under $30 [10]. Treat the mechanisms as documented and the volumes as unmeasured.
Her framing correction matters as much as the pricing. In the US these proxies are discussed as a security problem, while the buyer list runs through students, researchers, developers, tech employees, companies and hobbyists [14]. Ten percent of list is a ninety percent discount, the top end of the 70 to 90 percent range Qian describes [2], and a discount that large with a customer base that wide is a functioning consumer market. Markets of that shape are not closed by tighter checks at signup. They are closed, if at all, by raising the cost of the account supply feeding them.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
Chinese developers buy Claude tokens through so-called transfer stations at roughly ten percent of the official price, according to an analysis by Zilan Qian.
Operators push prices down partly by secretly swapping expensive models for cheaper alternatives, which the proxy can do because it sits between the user and the API.
Sellers reach prices 70 to 90 percent below Anthropic's list price.
The modular supply chain does not just undermine geoblocking; it also weakens Anthropic's ability to monitor misuse and can fuel criminal markets around identity and payment fraud.
Transfer stations are API proxies hosted on servers outside China; they accept API requests, forward them as if they came from a legitimate location, and relay the response back.
Users pay in Chinese yuan through WeChat or Alipay, needing no VPN and no foreign credit card, and popular transfer stations are catalogued in community directories ranked by price and availability.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Single secondary account of one analyst's work
All claims come from one publisher relaying one researcher's analysis; the concrete, checkable datapoint is the relayed CISPA benchmark on proxy model swapping. Key mechanisms -- KYC bypass, fraud-funded accounts, distillation buyers -- are explicitly hedged by the analyst as informal or unquantifiable, and no vendor data or second outlet corroborates anything.
Market clearly operating, volumes unmeasured
The cluster describes a functioning market with retail distribution: community directories ranking proxies, resale on Taobao, yuan payment rails, and a 17-proxy sample studied by outside researchers. But no transaction volumes, operator counts, revenue figures or Anthropic ban statistics are supplied, so breadth of use cannot be scored higher.
Sharp framing ahead of thin sourcing
The headline conclusion -- that provider region checks are a billing control, not a security one -- is a strong systemic claim resting on one policy-lab analysis with no vendor response, no enforcement data and self-acknowledged gaps in the identity-fraud and distillation portions. The overstatement is modest rather than severe because the write-up preserves the analyst's caveats and anchors the pricing mechanics in concrete levers.
Third-party analyst, no vendor promotion
The primary claims originate with a policy-lab researcher publishing through an outside outlet rather than with a vendor marketing a product, which limits promotional incentive. Residual incentives are real but secondary: a policy-lab framing that favours the conclusion that export-style controls fail, an aggregating trade outlet with an attention incentive on a China-and-Anthropic story, and profit-motivated proxy operators who are the ultimate source of much on-the-ground colour.
Plausible mechanism, unverified scale
The mechanism is internally coherent and partly corroborated by an external proxy study, so the existence of the gray market and of silent model substitution is credible. Single-publisher sourcing, absent vendor response and unquantified volumes keep confidence below the midpoint, especially for the identity-fraud, fraud-funding and distillation strands.
invest
Pick a side: Washington's draft AI letter turns model sourcing into a compliance problem1 distinct publisher
product
Model choice is becoming a line item, and the differentiator moved up the stack1 distinct publisher
product
The White House named 12 AI subfields. Open weights was not one of them.1 distinct publisher
product
The criminal AI market is a reseller business, and Grok's abuse desk is the chokepoint1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 23, 2026