AICreditMart, a website that calls itself "the marketplace for buying & selling AI credits", tells sellers they can "recover value" on credit they have not used. Its home page opens with a padlock and this promise: "100% Confidential — never shared with providers". Further down it says the same thing again, as a tick: "Never shared with AI providers". Buyers, it says, save 20 to 40 per cent. I loaded the page on 18 August 2026. That guarantee is not tucked away in the terms. It sits where a normal marketplace puts its buyer protection.
The trade it belongs to got a detailed public description on 10 August 2026, when Matt Lenhard of the security firm Vectoral published "Who Are the Token Brokers?". Lenhard went looking for the people buying unused credits from startups and reselling them, and emailed them. The first broker to reply, he writes, was offering $100,000 in spend per day. Lenhard also records how that broker handled delivery: they "aren't handing out the provider keys directly; instead, they act as a proxy that probably picks from a pool of keys and forwards the request." Across the sites, forums and resellers he examined, Lenhard estimates "tens of millions" of dollars in credits on offer, and calls that rough. AICreditMart itself lists credits from OpenAI, Anthropic, Google, Amazon Web Services, Microsoft Azure and, in its words, "20+ providers".
The easy piece to write from that is the one about a grey market appearing and fraud following it. That is probably true and it is not the interesting part. The interesting part is what a buyer is being sold. On the page I read, the strongest assurance AICreditMart offers is not about the goods at all. It is stated twice, and it concerns a party who is not in the room. The wording is that inquiries are confidential and "Never shared with AI providers". That is not a claim that the provider stays unaware of the sale, and I will not read one into it. The firmer point is that the three providers whose pages I read offer no way in. Anthropic's terms bar unapproved resale, and none of the three providers whose pages I read publishes a route for moving credit between accounts.
Why the guarantee is there at all
Start with why a guarantee like that finds a market. Anthropic's Commercial Terms of Service, effective 17 June 2025, state that a customer "may not and must not attempt to (a) access the Services to build a competing product or service, including to train competing AI models or resell the Services except as expressly approved by Anthropic". Express approval is the escape hatch in that clause, and none of the discount sites I read claims to hold it. On 18 August 2026 I also read the published terms and startup-programme pages at Anthropic, Amazon Web Services and Google looking for a sanctioned route to move granted credit from one account to another, and found none advertised.
That leaves the seller improvising, and the improvisations are not the same. CheapCredits, one of the bulk-discount sites Lenhard names, describes its product in its own page metadata as: "Access OpenAI and Anthropic Claude APIs at 40–60% below list price. Drop-in compatible relay, no code changes required." The site renders through JavaScript, so the marketing page says less than the description in the HTML head, where I read that. AICreditMart, by contrast, advertises "escrow-protected transfers" between a buyer and a seller and does not publish how a transfer is executed. I have not bought from either and cannot tell you what happens after payment on either one.
The sites do not say, and that is the point. A stranger's key serving your requests and an account you are borrowing are different arrangements carrying different risks. The two descriptions point in different directions, an escrow-protected transfer at one site and a drop-in relay at the other, and neither says what that means for whose account a given request lands in. In principle a seller could hold the express approval Anthropic's clause allows for, which would at least settle that clause. None of the sites I read says it has one.
The word the sellers picked
Lenhard uses the word relay in a specific sense and it is worth knowing which. In an earlier piece on 28 June 2026, he defined a relay, or transfer station, as a service that proxies traffic to United States models at a discount, and mapped the Chinese market built on them: card and account merchants at the top, account pools in the middle, relays selling to developers at the bottom. Almost all the ones he examined run one of two open-source gateways, one-api or new-api, which pull a key from a pool on each request, forward it upstream, and bill the buyer at a multiplier. He ranks the ten cheapest relays he tracks at median discounts between 94.1 and 97.8 per cent off official list price.
Nobody should read a business model off a discount, and 20 to 40 per cent is a long way from 97.8. But CheapCredits, which sells to Western developers in English, picked that same word for its own product, and the shape it describes is the shape Lenhard found at the broker who answered his email. That does not make them the same trade. It is consistent with the same constraint: with no transfer route on offer from the providers, the options left to a seller narrow quickly.
For anyone running agents rather than a chat product, my read is that this matters more than the price does. In my own use of coding agents, a question about a file puts a chunk of that file into the request, and tool results come back in on the following turn. How much that adds up to depends on the design, and I have no measurement of it. But the case where a discounted relay is most tempting is the long overnight run, and that is also the case where the request bodies are least like small talk.
The best argument for the brokers, and where it breaks
The case for this market is real and I do not want to caricature it. An expiring credit grant is deadweight. Amazon Web Services advertises up to $200,000 in Activate credits for startups, general cloud credit that it says is redeemable on third-party models on Amazon Bedrock. Google offers up to $350,000 in cloud credits to AI-first startups from seed to Series A. Someone thinks a decent share of that goes unused: Lenhard writes that the founders he spoke to "were getting a lot of inbound email from people looking to buy or sell off-market inference". On this argument a second-hand market turns a wasting asset into runway for the seller and cheaper compute for the buyer, and second-hand markets in unused prepaid entitlements are ordinary enough elsewhere. On the same argument, a provider that offers no transfer route has left a gap.
Cloud runs a version of the same idea in which the issuer is a participant, on a different asset. In the Amazon EC2 Reserved Instance Marketplace, customers list unused Standard Reserved Instances, which are term commitments that buy a discount on compute rather than credit balances, and Amazon's documentation says AWS "processes the transactions and transfers ownership of the Reserved Instances to the buyer". So reselling a cloud commitment second-hand is not inherently illegitimate. That is the strongest objection to anything I have said so far, and it lands.
Where I think it stops landing is in the detail of the same Amazon documentation. AWS charges a service fee of 12 per cent of the upfront price on every Reserved Instance sold through that marketplace. Sellers must register, and the bank account they nominate must have a United States address. Amazon states that it "shares your company's legal name on the buyer's statement in accordance with US regulations", and passes the buyer's postcode and country back to the seller. The issuer runs the venue, takes a cut, and puts the seller's legal name in front of the buyer. The reservation changes hands through AWS and its discount attaches to the buyer's own account. Nothing about how the buyer runs anything changes.
Set that beside a venue whose headline assurance is that inquiries never reach the issuer. My rule of thumb, and it is a rule of thumb rather than a finding, is that a second-hand market is about as trustworthy as the issuer's involvement in it. The distance between those two ends is not price.
A second objection deserves the same seriousness: intermediaries as such are fine. Lenhard says so himself about the gateway software the relays run on, writing that "one-api and new-api are neutral, legitimate tools" and noting that companies self-host them to put their own accounts behind one endpoint with team quotas and spend tracking. That is correct, and it is why architecture settles nothing on its own. What separates the cases is disclosure. A router selling capacity it bought under its own name is at least a counterparty you can name in a contract and chase later. That is not the same as one authorised to resell, and it is a starting point you otherwise do not have. Nothing on the pages I read offers the buyer a contract with the account holder upstream, and a venue that markets confidentiality from the provider is not the likeliest place to be handed one.
What I can verify, and what I cannot
The pitch from the bulk-discount sites is that the prices come from volume. Lenhard doubts it, writing of CheapCredits that "a 40% discount is very unlikely unless you are one of the provider's top customers", and that his hunch is the supply is sourced some other way. That is a hunch, he labels it as one, and I will not launder it into a finding. What I can verify is narrower and still enough to act on: these sites say what I have quoted them saying, the words they choose for the mechanism are relay, proxy and transfer, one large provider's terms forbid reselling its Services without approval, and no provider I checked publishes a way to move credit. The size of the market is Lenhard's own estimate, and he labels it as rough.
Lenhard also notes that CheapCredits publishes a data processing agreement for buyers who need cover under European privacy law. Take it at face value and it still binds only the operator who signed it. In the arrangement Lenhard actually documented, where a broker forwards requests using keys from a pool, the useful question is whether that agreement obliges the operator to identify the account behind the request. That is the clause worth asking for, and I would not assume a venue built on confidentiality will agree to it. Whether the listing marketplaces work the same way I cannot say, and neither, from what is published, can their buyers.
The bet
My expectation is that enforcement bites hardest on the fraud supply, because that supply leaves marks. Lenhard's June piece sets out what defenders watch: bulk account creation, prepaid and virtual cards, mismatched billing details, card testing, time from registration to first token, plus behavioural signals and alerts on cost anomalies. Most of the items on Lenhard's list fire at sign-up or at payment. The behavioural half, in his framing, hunts for "patterns no real user produces", and my expectation is that a funded company with a real card, a shipped product and a year of history does not produce them, whoever is actually paying for the prompts. That is a guess about detection, and the providers can see billing patterns I cannot.
So, the falsifiable part, with the reasoning rather than just the call. Demand for cheaper inference is not something I expect to fade. The grant supply comes out of programmes the providers advertise themselves, Amazon's Activate credits and the Google for Startups Cloud Program among them, so it starts inside real companies. For the reason above, I expect much of it to sit outside the controls Lenhard describes. On that basis: if no large model provider ships an official way to transfer granted credit between accounts, on the record and for a fee, within the next twelve months, then the credit marketplaces will still be listing OpenAI and Anthropic credit at 20 to 50 per cent off in August 2027. Check AICreditMart and CheapCredits then. If they have gone quiet with no transfer mechanism having appeared, my read is wrong, and the likeliest reasons would be that the supply really was the stolen kind, or that provider enforcement reaches further into aged legitimate accounts than I expect.
The cheaper check is available today and costs nothing. Ask whoever sells you discounted inference which account of record your requests get billed against, and ask for it in the contract. A vendor that answers has given you something you can check. If the answer is that it changes from request to request, or that nobody will put one in writing, then you have learned the thing worth knowing before the invoice arrives.