How China's grey market sells Claude tokens for a fraction of the official price

Anthropic blocks Chinese users from its AI model Claude through geoblocking, selfie verification, and now even iris scans, but a network of so-called 'transfer stations' renders those barriers largely irrelevant. Chinese developers, students, and companies are purchasing API access to Claude through these intermediaries for amounts that sometimes amount to ten percent of what Anthropic itself charges. The grey market is openly advertised on platforms such as Taobao, Telegram, GitHub, and the second-hand platform Xianyu.

Researcher Zilan Qian of the Oxford China Policy Lab documented the ecosystem in a detailed essay in ChinaTalk, published in May 2026. Her analysis makes clear that the circumvention is not limited to individual hobbyists: large tech companies and AI labs also make use of it, sometimes through structured arrangements involving foreign subsidiaries.

How the transfer stations work

A 'transfer station', in Chinese 中转站, is an overseas API proxy that acts as an intermediary between a Chinese end user and Anthropic's servers. The operator holds a valid account outside China, purchases API credit from Anthropic, and resells it to Chinese customers, often at discounts of seventy to ninety percent. One common benchmark in the market sets the exchange rate at one yuan per dollar of API credit, a fraction of the official rates.

Many of these proxies are based in Singapore, which minimises the geographical distance to Anthropic's services and creates legal grey areas. The services are not kept hidden: sellers advertise openly on consumer platforms and in Telegram groups. Those wishing to bypass biometric verification can turn to the black market for that purpose. Iris scans for verification purposes are reportedly available for less than thirty dollars, sourced from low-income countries.

Vuk Dukic, founder of Anablock and senior software engineer, is one of the voices who has shed light on the practical workings of this ecosystem in public discussions on the topic. The user base is broad: the market serves millions of Chinese developers, university professors, app developers, and tech company employees.

Major tech companies appear in the reports

The circumvention extends beyond individual users. In February 2026, Anthropic accused a number of Chinese AI labs, including DeepSeek, Moonshot, and MiniMax, of systematically querying Claude outputs to train their own models. This is said to have occurred via more than sixteen thousand fraudulent accounts, accounting for over sixteen million exchanges.

Earlier, during the period from April to June 2026, Anthropic turned its attention to Alibaba-affiliated entities. These are alleged to have generated nearly twenty-nine million exchanges using approximately 25,000 fake accounts in what Anthropic described as 'large-scale distillation campaigns', the structured harvesting of model output. Alibaba subsequently banned its employees from using Claude Code, after hidden code was discovered in that software that could identify Chinese users.

ByteDance is said to have reimbursed engineers for personal Claude subscriptions used via VPNs. Ant Group, Alibaba's financial arm, is alleged to have gained access through a Singapore-based subsidiary. Microsoft Azure serves in some cases as an additional intermediary: Chinese companies managing an Azure account through foreign subsidiaries can use that route to reach Claude as well.

Mounting pressure on Anthropic's access controls

Anthropic has tightened its access rules in stages. A first round of stricter controls followed in September 2025. In April 2026, the company introduced biometric KYC verification, requiring selected users to submit an iris scan. Since then, Anthropic has been intensifying its efforts to block unauthorised access from China, as multiple sources reported in July 2026.

Each new measure is followed by adjustments within the circumvention network. The iris scan market is a direct consequence of this. Zilan Qian argues in her analysis that the infrastructure behind the transfer stations not only harms Anthropic's commercial interests, but also undermines the effectiveness of broader export controls on AI technology. Her point is that the safety measures Anthropic embeds in its terms of use and training policies are difficult to enforce when access itself flows through intermediaries that Anthropic has no visibility into.

Broader implications for AI access policy

The situation illustrates a structural problem for Western AI companies seeking to shield their models from certain markets. Technical barrier-raising, from IP blocks to biometric verification, increases the cost of circumvention but does not eliminate it. As long as the price differential is large enough and demand remains high, an economic incentive exists for intermediaries to bridge the gap.

For European policymakers and AI companies thinking about access controls on sensitive models, the Chinese grey market for Claude offers concrete reference points. It demonstrates that technical measures and export controls on AI services are only effective if they also address the layer of commercial intermediaries and cloud pass-through channels. How to enforce this in practice remains an open question in the European context as well.