In the first week of May, Justin Sun, Fu Sheng and the Trump family successively entered the market to sell AI tokens. In the same month, a relay-station operator in Shanghai was criminally detained for 37 days. This business, known as "AI middleman reselling," can reach monthly turnover of RMB 5 million with a gross margin of 50 percent. This article calculates only one thing: where exactly that 50 percent gross margin comes from so explosively, and why, in the same business, some people get rich from it while others end up in a detention center because of it.
On May 1, Justin Sun posted on X that his AI relay station B.AI had launched. One API Key connects Claude, GPT, Gemini and the full range of domestic models, with blockchain login, anonymous payment and the lowest prices on the entire internet. A few days later, Fu Sheng of Cheetah Mobile launched EasyRouter, with the slogan of a 15 percent discount sitewide and one Key calling more than 40 mainstream large models. Later still, WorldClaw, a crypto project deeply tied to the Trump family, launched, with a top-tier package priced at USD 9,999; buyers could also enter a draw for a voucher to have dinner with Donald Trump Jr.
In the same week, in the same business, three names with no apparent connection to one another. On Zhihu, a question asking "Why are they all going into AI relay stations?" quickly passed 750,000 views.
Also in that May, an AI relay-station operator in Shanghai posted that, because of operating the relay station, he had been criminally detained by police for 37 days; he is currently released on bail pending trial, the case has entered the investigation stage, and the charge is very likely illegal business operation. Almost at the same time, the Ministry of State Security issued a notice warning of the data security risks of AI relay stations, and the Cyberspace Administration of China listed "abusing AI technology and failing to file as required" in its "Qinglang" special rectification campaign.
On one side is the highly lucrative trend of celebrity endorsements; on the other is the first criminal detention order in this sector. These two things are not contradictory—they describe two sides of the same business.
A business that can open with one line of Docker
First, let us be clear about what this business is. Its technical essence is a reverse proxy layer placed between users and AI model vendors: you send a request to the relay station, the relay station forwards it to the official interface of OpenAI or Anthropic using a batch of overseas accounts it has stockpiled, retrieves the result and returns it to you. To you, it seems as if you are dealing with a domestic server, and the existence of overseas models is technically hidden.
What makes it a business are two real gaps.
The first gap is the price difference, and it is absurdly large. An OpenAI Pro subscription costs USD 200 a month, but if you go directly through the API on a pay-as-you-go basis, the equivalent call volume may work out to several thousand US dollars a month, a difference of a hundred times. Claude is even more extreme: a Claude Max subscription account costs USD 200 a month, but at official API pricing, the call volume it can carry is worth USD 400 to 600. Holding a USD 200 account and selling it in pieces can bring in USD 2,000 to 3,000, and when the market is good, USD 4,000 to 5,000.
The second gap is the threshold. Domestic developers who want to buy overseas APIs directly are blocked at three points: no payment channel linked to an overseas card, no stable network access, and no proper invoice that can be booked. The relay station gets them through all three at once, and can even issue corporate invoices.
With demand in place, what remains is supply, and on the supply side there is almost no cost. The open-source community has laid the infrastructure out cleanly over the past two years: a project called One API, with 35,000 stars on GitHub, written in Go, can be deployed with one Docker command and supports almost all mainstream models; New API, developed secondarily on its basis, also filled in commercial features and became the de facto foundation for most relay stations. In the words of one practitioner quoted by Jiemian News, a person only needs to know how to open a Claude or GPT subscription to do this business, and even paying someone to set it up works just the same.
How low is the threshold? The industry directory TokenNav counted that, as of 2026, at least 92 such products were running domestically and overseas. An investor told Jiemian News that a relay-station project he was watching could reach monthly turnover of RMB 5 million, with a gross margin of almost 50 percent.
One caveat: this USD 5 million figure is for a single leading project, as relayed by one investor, without public transaction records to corroborate it, and it is not the industry median. The operations of the vast majority of site operators are far smaller than this. But the structure of a 50% gross margin is real.
A 50% gross margin means the 50% compliance cost is exactly what is being saved
Here is the question: for a business that can be launched with a single line of Docker and that 92 people are competing to enter, why does it still command a 50% gross margin?
Let us break down the accounts. On the revenue side, a USD 200 account is resold in pieces for USD 2,000 to USD 3,000, an arbitrage of 10 to 15 times; at this layer alone, the cost of goods accounts for less than 30% of revenue. What really eats into gross margin is not the goods but other things: overseas accounts are constantly banned by vendors and must be kept alive continuously with scripts; the industry-wide error rate for API calls is generally 15% to 20%, and only by writing one's own code to tune it can it be pressed down to 5%; and there is customer acquisition. It is these labor and attrition costs combined that drag the 50% gross margin down from a higher level.
In other words, the "50% gross margin" is not the ceiling of this business; it is what the business looks like after being worn down by operational attrition. The pure arbitrage link alone is fatter than 50%.
So what exactly does the other 50% of cost, or rather, this business compared with a genuinely compliant peer, save? A rough calculation based on public figures shows that a player who wants to make this business formal would have six additional items of expenditure on its books (the following are all estimates as a share of revenue, and the assumptions may be replaced as one sees fit): VAT that must be actually paid when issuing invoices to enterprises, about 6 points, because overseas APIs cannot obtain Chinese VAT input credits, so the output tax must be borne by oneself; corporate income tax, which works out to another few points; the amortization of restructuring for obtaining a value-added telecommunications license and completing algorithm filing; security assessment for cross-border data transfer; replacing cheap overseas servers with compliant dedicated lines; and switching the source of goods from "a pool of accounts harvested through promotions" to "official enterprise-grade wholesale," which itself raises the purchase price.
Add the six items back, and the gross margin falls from 50% to around 20%.
This 20% happens to fall within the industry gross-margin range for businesses such as wrapper and relay services. It also happens to corroborate the account of another path: if one uses already-filed domestic models such as SiliconFlow, Zhipu, and Alibaba Cloud Bailian to operate compliant domestic B2B relay services, policy risk can be reduced by 70%, but profit is also halved.
This is the one sentence about this business that most needs to be seen clearly:That extra thirty points of gross margin is not earned by technology; it is obtained by saving thirty points of compliance cost. The amount of the windfall profit is almost exactly equal to the amount of compliance cost saved.
Not a cent more, not a cent less.
Ledger
It has no moat, only a window of time
Cost savings can buy windfall profits, but they cannot buy safety, because this business has virtually no moat.
First, look at where it stands. The relay station occupies the most fragile slot in the industrial chain: it does not produce models, does not control computing power, and only handles transport. Upstream are OpenAI and Anthropic, whose terms of service expressly prohibit reselling APIs and who can suspend accounts, cut prices, and change rules at any time. On April 5, the head of Claude Code directly announced that Claude subscriptions would no longer support third-party harness platforms; in one sentence, the supply source of a group of site operators who made a living from Claude accounts evaporated that day. The price spread on which the relay station depends for survival was itself a byproduct of upstream pricing; every time upstream cuts prices, the gross margin of this business is passively thinned by another layer.
Next, look downstream. The relay station's customers have more worry-free alternatives on all three sides. Those who find it too expensive can have the enterprise itself set up an One API gateway to connect directly to the official service, saving all the middleman's profit, and this gateway uses the very same open-source code as the relay station; those who need compliance can connect directly to already-filed domestic models, in one step; those who need stability can use official direct connections with zero intermediary layers. The relay station's position depends on three conditions holding simultaneously: the customer "neither wants to build its own, nor accepts domestic models, nor is willing to connect directly to the official service." As long as the customer understands a little more or is a little more diligent in any one dimension, there is no need for it to exist.
On the same layer, 92 competitors are also crowded in. How far has the price war gone? A 2026 paper published at the ACM Internet Measurement Conference empirically tested a batch of commercial gateways: at more than 40% of endpoints, the model you call is not the one it claims to sell you; and some gateways actually charged 62.8% more than they should have. After the race to the bottom, everyone relies on watering down, secretly altering multipliers, and passing off cheap models as expensive ones to squeeze out profit.
The ceiling of this business is also not as high as imagined. Demand-side volume is indeed enormous: according to data from the National Data Administration, in 2025 the national daily average token call volume rose from over one trillion at the beginning of the year to 100 trillion at the end of the year. But the relay station only captures a small slice: "rushing to overseas models, needing to bypass access, and seeking that bit of price spread," and this small slice is being eaten away year by year by domestic models. The celebrity brings one-off attention; the heat comes with OpenClaw and leaves with OpenClaw. Capital is betting on something else: SiliconFlow is sprinting toward a Hong Kong listing and igniting the "Token Factory" narrative; VC is betting on the payment and settlement layer in the AI Agent era, a game in which one can lose nine and bet on one. An individual site operator does not have this card; what he earns is the real operating price spread, and once upstream cuts prices, suspends an account, or files a case, he must leave the field.
Taking VC's narrative as one's own business model is the most expensive misunderstanding in this business.
So by this point, the conclusion is already clear: a 50% gross margin is real, and the moat is zero. It is not a business with barriers; it is an arbitrage with a window of time, and the button that closes the window is not in the site operator's hands.
Now, add in the last cost item
The accounts calculated above have not yet included the last item. And this item is precisely the one that determines the life or death of this business.
The model of that site operator in Shanghai is exactly the same as described above: reverse proxy plus account pool, bulk registration and purchase of Claude and GPT accounts, scripted account maintenance, overseas servers to set up proxies, advertising a low price of "1 yuan for millions of tokens," and reselling the interface to domestic users. The characterization given by the public security authorities is suspected illegal business operation, and the prosecution threshold is frighteningly low: under current standards, an illegal business amount of 50,000 yuan or more, or illegal gains of 10,000 yuan or more, is enough to file a case. Compared with the 5 million yuan monthly turnover of a leading project, a fraction of one month crosses the line.
This is not something that can be waved away with a reminder to 'pay attention to compliance.' The six compliance costs you saved are different in nature, and different in price. Divided by whether money can solve them, they fall into three tiers.
Tier one: costs that should have been calculable in money. The fixed overhead of legitimate operators is obtaining licenses, completing filings, and implementing content review. A relay station provides cross-border information relay and data processing services; in the eyes of regulators this falls within value-added telecommunications services, requiring operating licenses such as ICP, EDI, or IP-VPN. The licensing hurdle is a matter of money and time, and it can be cleared. What truly cannot be cleared is the next hurdle: to provide generative AI services to the domestic public, one must first pass algorithm filing and security assessment, and the Claude and GPT you resell simply cannot be filed domestically under current requirements, because overseas large models do not meet China's content and data security review requirements. This means that as long as your goods remain overseas models, 'spend money on licenses and you are compliant' is an illusion; the licenses can be obtained, but the road remains blocked. For tier one to truly become 'solvable with money,' the precondition is first to change the source of goods, replacing Claude and GPT with already-filed domestic models such as SiliconFlow and Zhipu. This act of changing goods is the master switch that downgrades the criminal risk of the next two tiers into a determinate compliance cost in one stroke.
Tier two: risks that can be settled by paying money. This tier is probabilistic and can be resolved by paying some money; many bosses, after doing the math, find it acceptable. The most typical are false advertising and commercial confusion: claiming to sell Claude while the backend connects to a different model; or borrowing official names and icons to burnish one's own image. There is already a batch of real penalty decisions along this line. In 2023, a Shanghai company operating the 'ChatGPT Online' WeChat public account, using icons highly imitating OpenAI and calling itself the 'ChatGPT Chinese version,' collected 4,231 paid members and was fined RMB 62,692.7 by the market supervision authorities under the Anti-Unfair Competition Law. This year, the State Administration for Market Regulation published five typical cases of unfair competition in the AI field at once: those imitating DeepSeek to free-ride with 'local deployment tools' were fined between RMB 5,000 and RMB 30,000; those using AI outbound-call software to impersonate banks in promoting loans were fined RMB 200,000.
By the boss's calculation, this tier is quantifiable: the single-incident cost depends on the range of damages awarded and fines, from several thousand to two hundred thousand, with the statutory minimum fine for false advertising starting at RMB 200,000; the probability of occurrence depends on how conspicuous the conduct is and whether anyone reports it. The math comes out acceptable, and the industry does indeed often treat it as an operating cost. Where a lawyer can help is in calculating this number accurately and then finding ways to minimize it: do not touch official trademarks and names on promotional pages, state whichever model is actually called, and make billing multipliers transparent and verifiable; achieve these three, and the cost of this tier is largely compressed.
Tier three: the line that money cannot settle. This tier cannot be resolved by paying money, because it corresponds to personal liberty and qualifications; the formula fails here. The core act of this business hits three lines at once.
One is illegal business operation. Article 225 of the Criminal Law provides that whoever, in violation of state regulations, engages in other illegal business operations that seriously disrupt market order, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than five years or criminal detention, and shall also, or shall only, be fined not less than one time but not more than five times the illegal gains; if the circumstances are especially serious, shall be sentenced to fixed-term imprisonment of not less than five years. Operating value-added telecommunications services without a license is the most direct entry point for this crime. Looking back for reference, precedents with highly consistent logic already exist: a paid circumvention proxy service case in Taizhou, Zhejiang, case number (2018) Zhe 0329 Xing Chu No. 46, was sentenced for illegal business operation to 1 year and 6 months, suspended for 2 years, with a fine; a cross-border accelerator proxy case in Hefei, Anhui, case number (2018) Wan 0111 Xing Chu No. 885, received a custodial sentence, with all illegal gains confiscated. The Shanghai AI relay station case is not essentially different from them in its conduct.
The second is infringement of citizens' personal information. The prompts and context users send in are fully visible to the relay station when forwarding, and can be retained. There has long been an industry practice of relay stations packaging such data and selling it to model vendors for training. Once this is done, it touches Article 253-1 of the Criminal Law: whoever sells or provides citizens' personal information to others, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention; if the circumstances are especially serious, to not less than three years but not more than seven years.
The third point is the most concealed, hidden in the selling point that looks most like a compliance bonus: the ability to issue proper corporate invoices. Enterprise clients need invoices for booking expenses, and this is a rigid demand; many grassroots relay stations also advertise "corporate account payments accepted, invoices available" as a selling point. But the problem is that overseas APIs cannot obtain Chinese VAT input credits. You have no genuine input invoices in hand, yet you issue output invoices to downstream parties, which under the Measures for the Administration of Invoices constitutes issuing invoices inconsistent with actual business operations. Once the amount reaches the criminal threshold, this corresponds to the crime of falsely issuing special VAT invoices under Article 205 of the Criminal Law, starting at up to three years, three to ten years for relatively large amounts, and ten years to life imprisonment for especially large amounts. In a case of false invoicing by a network freight platform investigated by the Xi'an tax authorities and public security, the nature was that a "middleman" issued a large volume of invoices without genuine business support, and the principal offender has been arrested. The ability to issue invoices is not itself a moat; if handled poorly, it is a knife handed to oneself.
Now add these three tiers back into the earlier account. The fifty percent gross margin must be multiplied by a probability of case exposure, then subtract all illegal gains that may be confiscated, and also subtract the loss of the business going to zero once a person is imprisoned; for most people the math comes out negative. Among the three tiers, tier two can be covered by paying money, tier three cannot; and tier one is the most subtle—it should be a determinate cost of spending money on licenses, but as long as the goods remain overseas models, the money is spent and the licenses obtained, yet the road remains blocked. The three tiers stacked together point to the same action.
Three-tier red line
For this business to be viable, there is only one path: move the line-crossing actions back inside the line. Change the source of supply from a pool of subscription accounts that breaches the terms to official enterprise-level procurement; change the model from an overseas interface that cannot be filed for record to a domestic model that has already been filed, used for B2B relay; build invoices on genuine input transactions, with no cross-border data transfer, no data retention and no resale. After these changes, gross margin drops from fifty percent to twenty percent, but only then does it first become a business that can be sustained over the long term. For anyone who cannot make these changes, it is not a business; it is a summons that will arrive sooner or later.
Switching to domestic models is another, more crowded business
Switching the goods to domestic models can reduce criminal risk back to a compliance cost, but that amounts to walking out of a blocked road and into a more crowded room.
At the domestic-model layer, supply is readily available, and the players are still waging a price war among themselves. SiliconFlow, Zhipu, Alibaba Cloud Model Studio, Volcano Engine and DeepSeek—a host of platforms that have already been filed for record—are undercutting each other on per-Token pricing. Even the water sellers are bleeding: SiliconFlow is sprinting toward a Hong Kong listing on the narrative of a “Token factory,” yet its books show that the more it sells, the more it loses, and it is asset-heavy.
What is more troublesome is that the big platforms are both your upstream and your competitors. Giants such as Alibaba Cloud, Volcano Engine and Tencent, which have their own MaaS platforms, are themselves selling Tokens directly, at lower prices and with more standardized invoicing. To use the exact words of the practitioner quoted in Jiemian News, the big platforms will eat most of the market, and only what is left is the small individual operators' share.
So on the domestic-model track, the “channel” itself is utterly worthless, because the big platforms are themselves the channel. What small players can still hold on to are the jobs the big platforms cannot be bothered to bend down and do: the compliance channel for a particular vertical industry, private deployment, services that bundle invoice booking and data compliance, and hands-on after-sales support. The nature of the business changes at this point: from “selling cheap Tokens” to “selling compliance and services”—thin margins, but a long life.
There is also a fork in the road: turning the direction around. Domestic models have a cost advantage in computing power and electricity; helping overseas users use domestic models—exporting rather than importing—precisely bypasses the two dead knots of domestic filing for record and cross-border data transfer. Among the peers of that site operator in Shanghai, some have already turned to taking domestic Tokens overseas. But that is another business, with accounts to be settled in another article.
Who holds the cards, and who should fold
The same reverse proxy, in different hands, is an entirely different matter. The difference is not in the technology; it is in whether you hold those few cards.
If you already have value-added telecommunications qualifications in your name, cloud channels, and a licensed corporate entity that can issue invoices, this business is almost a giveaway for you. The compliance wall that others have to climb over is merely a near-zero marginal cost for you, and you can stand directly in the most rule-abiding tier: official wholesale plus corporate invoicing, taking filed domestic models for enterprise relay. Profit is halved, but those 92 peers who can only build shells cannot get through your door. At this position, compliance is no longer a cost; it is a barrier.
If you hold a batch of enterprise clients but have not yet obtained the qualifications and filings, then do not rush to hang out your shingle; wait for two signals. One is that your own value-added telecommunications and algorithm filing certificates are actually in hand; opening for business before that would be the 37 days of that site operator in Shanghai. The other is that only after this round of special rectification clears out a batch of the gray industry will the trust premium of compliant channels become apparent, and entering at that time is more worthwhile. Your resources match this business; all that is missing is a piece of paper, and it is worth the wait.
The people who least ought to make a move are those who have neither qualifications, nor channels, nor enterprise clients, and can only use open-source frameworks to build an account pool. Look carefully at the odds of this bet: the upside is a small price spread that can be wiped out by upstream at any time, while the downside is Article 225 of the Criminal Law, with a prosecution threshold so low that it is reached at illegal gains of RMB 10,000, and the first person in this track has already been criminally detained for 37 days. The compliance costs you save are mortgaged against your freedom; every lever in your hands—the account pool, the accounts, the open-source frameworks—has its property rights in someone else's hands, and a single upstream move can reduce it to zero. This is not moral talk about not doing something because it is illegal; it is an account with a negative expected value.
Returning to the three celebrities mentioned at the beginning: this business will not become legal because the Trump family enters, will not become transparent because of Justin Sun's blockchain narrative, and will not truly be worth the money because Fu Sheng offers a 15% discount. What they are selling is something else entirely—coins, listing stories, a political ticket. Whether the relay business itself makes money is not important to them.
The only person who truly stakes their entire fortune on this business itself is the individual site operator who builds an account pool with real money and hopes to turn things around on a 50% gross margin. And of that 50% gross margin he stakes, 30% is, in the first place, the price of criminal risk.
Author of this article:Lü Yinghui, a lawyer at Mankun (Shenzhen) Law Firm. A graduate of China University of Political Science and Law, with nearly ten years of deep experience in the legal industry, and having previously worked at a court in Shenzhen. Focused on legal services in the new-generation economy, with extensive practical experience and profound insights in fields such as Web3 and artificial intelligence. Account on all platforms: Lao Lü Talks New Money; you are welcome to follow.
