In the first week of May, Sun Yuchen, Fu Sheng, and the Trump family sequentially entered the market to sell AI tokens. In the same month, a station manager in Shanghai was detained for 37 days. This business, dubbed “AI middlemen,” can generate monthly revenues of up to 5 million yuan with a gross profit margin of 50%. This article focuses on one thing: where exactly that 50% gross profit comes from, and why, in the same business, some people grow rich while others end up in detention.
On May 1, Sun Zhenchen posted on X that his AI intermediary platform, B.AI, had launched—using a single API key to access Claude, GPT, Gemini, and the full range of domestic models, with blockchain login, anonymous payments, and the lowest prices online. A few days later, Fu Sheng of Cheetah Mobile launched EasyRouter, promoting a 15% discount across the board and a single key to access over 40 major models. Later still, a crypto project deeply tied to the Trump family launched WorldClaw, with its top-tier plan priced at $9,999 and including a chance to win a dinner voucher with Donald Trump Jr.
In the same week, in the same business, three completely unrelated names. The question on Zhihu, “Why are they all becoming AI intermediaries?” quickly surpassed 750,000 views.
Also in May, a station manager of an AI relay station in Shanghai posted that he was criminally detained for 37 days due to operating the relay station and is currently released on bail; the case has entered the investigation phase and is likely to be charged as illegal business operation. Almost simultaneously, the Ministry of State Security issued a warning about data security risks associated with AI relay stations, and the Cyberspace Administration of China included “abuse of AI technology and failure to register as required” in its “Clear and Clean” special rectification campaign.
On one side is the lucrative trend of celebrities promoting products; on the other is the first arrest warrant in this industry. These two events are not contradictory—they represent two sides of the same business.
A business you can launch with a single Docker command
First, let’s clarify what this business actually is. At its technical core, it’s a reverse proxy layer between users and AI model providers: you send your request to an intermediary, which then uses its own stock of overseas accounts to forward the request to OpenAI or Anthropic’s official APIs, retrieves the response, and sends it back to you. To you, it appears as if you’re interacting with a domestic server—the presence of overseas models is technically concealed.
It can become a business by exploiting two real gaps.
The first gap is the price difference, and it’s enormous. OpenAI’s Pro subscription costs $200 per month, but if you were to use the API on a pay-per-use basis, the equivalent usage would cost thousands of dollars per month—hundreds of times more. Claude is even more extreme: a single Claude Max subscription costs $200 per month, but according to the official API pricing, the equivalent usage value would be $400 to $600. With one $200 account, if you break it down and resell it, you could fetch $2,000 to $3,000—and during peak demand, up to $4,000 to $5,000.
The second hurdle is the barrier. Domestic developers wanting to directly purchase overseas APIs are blocked by three obstacles: no payment channels linked to foreign cards, no stable internet access, and no legitimate invoices eligible for accounting. The intermediary solves all three hurdles at once—and can even issue corporate invoices.
With demand in place, the rest is supply—and the cost on the supply side is nearly negligible. Over the past two years, the open-source community has thoroughly laid out the infrastructure: a project called One API, with 35,000 stars on GitHub, written in Go, deployable with a single Docker command, and supporting nearly all major models; built upon it, New API has added commercial features and become the de facto foundation for most intermediaries. As one industry professional put it in Jiemian News, all you need to do is subscribe to Claude or GPT, and you can run this business—even if you simply pay someone else to set it up for you.
How low are the barriers? According to TokenNav’s industry directory, at least 92 such products were already operational domestically and internationally by 2026. One investor told Jiemian News that a transit project he was monitoring had a monthly transaction volume of 5 million yuan, with a gross margin of nearly 50%.
Just a reminder: this $5 million figure refers to a single top-tier project, as relayed by one investor, with no public transaction records to verify it—it is not the industry median. Most site operators’ volumes are much smaller than this. However, the 50% gross margin structure is indeed accurate.
Fifty percent gross profit; the savings come from that fifty percent in compliance costs.
Here’s the question: How can a business that starts with a single Docker command and is being competed for by 92 people still maintain a 50% gross margin?
Break down the costs and revenues. On the revenue side, a $200 account is split and sold for $2,000 to $3,000, yielding a markup of 10 to 15 times. Just at this level, the cost of goods accounts for less than 30% of revenue. What truly eats into the gross margin isn’t the product itself, but other factors: overseas accounts are frequently banned by manufacturers, requiring automated scripts to continuously maintain and keep them active; industry-wide API error rates typically range from 15% to 20%, and must be reduced to around 5% through custom-coded adjustments; there’s also customer acquisition. When you add up the labor and operational losses from these factors, that’s what brings the gross margin down from a much higher level to around 50%.
In other words, "a 50% gross margin" isn't the ceiling of this business—it's what remains after operational losses have been worn down. The pure arbitrage component is even more profitable than half.
What about the other 50% of costs—or, in other words, what exactly does this business save compared to a fully compliant competitor? Based on publicly available figures, a player aiming to operate legitimately would incur six additional expenses on their books (all estimates based on revenue percentage; feel free to substitute your own numbers): VAT paid upon issuing corporate invoices—roughly 6%, since overseas APIs don’t qualify for input VAT credits in China, meaning the output tax must be borne entirely by the business; corporate income tax, equivalent to several more percentage points; amortization costs for obtaining an增值电信牌照 (value-added telecommunications license) and completing algorithm registration; data cross-border security assessments; replacing inexpensive overseas servers with compliant dedicated lines; and switching sourcing from “scalper account pools” to “official enterprise-level wholesale,” which inherently raises procurement costs.
Six transactions were added back, reducing the gross margin to around 20%.
This 20% falls precisely within the industry gross margin range for shell and intermediary businesses. It also corroborates another perspective: if you leverage already-registered domestic models such as Silicon Flow, Zhipu, and Alibaba Cloud’s Bailian to facilitate compliant B2B intermediation in China, policy risks can be reduced by 70%, but profits would also be halved.
This is the most crucial truth about this business: the additional 30 percentage points of gross profit are not earned through technology, but by eliminating 30 percentage points of compliance costs. The magnitude of the windfall is almost equal to the amount of compliance costs saved.
Not a penny more, not a penny less.
It has no moat, only a time window.
Cutting costs may bring huge profits, but it cannot buy security, because this business has almost no moat.
First, look at its position in the chain. The intermediary sits in the most vulnerable link of the supply chain: it doesn’t produce models, doesn’t control computing power, and merely acts as a middleman. Upstream are OpenAI and Anthropic, whose terms of service explicitly prohibit reselling APIs—they can suspend accounts, lower prices, or change rules at any time. On April 5, the head of Claude Code directly announced that Claude subscriptions would no longer support third-party harness platforms; in one statement, a batch of website operators who relied on Claude accounts lost their entire supply overnight. The margin that sustains these intermediaries is merely a byproduct of upstream pricing—each time the upstream lowers prices, the profit margin of this business is automatically squeezed further.
Now look downstream. The midstream station’s customers are surrounded by easier alternatives on all sides. Those who find it too expensive can set up their own One API gateway directly connected to the official source, eliminating the intermediary’s profit entirely—using the exact same open-source code as the midstream station. Those needing compliance can directly integrate with pre-approved domestic models in one step. Those seeking stability benefit from direct official connections with zero intermediaries. The midstream station’s position relies on customers simultaneously refusing to build their own infrastructure, rejecting domestic options, and avoiding direct official connections. As soon as a customer becomes slightly more informed or proactive in any one of these areas, the midstream station becomes unnecessary.
The same layer is crowded with 92 competitors. How far has the price war gone? A 2026 paper presented at the ACM Internet Measurement Conference tested a batch of commercial gateways and found that over 40% of endpoints delivered a model different from the one they claimed to sell you; some gateways even charged 62.8% more than they should. In the end, everyone is squeezing profits by inflating metrics, tampering with multipliers, and substituting cheap models for expensive ones.
The ceiling of this business isn't as high as it seems. Demand is indeed massive—according to the National Data Bureau, daily token usage across the country rose from over a trillion at the start of 2025 to 100 trillion by year-end. But the middleman only captures a tiny slice: those seeking to route traffic overseas, bypass access restrictions, and profit from minor price differentials. And this small slice is being steadily consumed year after year by domestic models. Celebrities bring only one-time attention—hype rises and falls with OpenClaw. Capital is betting on something else: silicon-based liquidity racing toward Hong Kong’s stock market and igniting the “Token Factory” narrative. VCs are wagering on the payment and settlement layer for the AI Agent era—a game where you can lose nine times and still win big with one hit. Individual site operators don’t hold this card; they earn only real, tangible operational spreads. When upstream prices drop, accounts get shut down, or investigations begin, they’re forced to exit.
Treating VC narratives as your business model is the most expensive misconception in this business.
So by now, the conclusion is clear: a 50% gross margin is real, but there is no moat. It’s not a business with barriers—it’s a time-limited arbitrage opportunity, and the timer isn’t controlled by the site operator.
Now, add the last cost.
The previous calculations haven't included the final item—and this one is precisely what determines whether this business lives or dies.
The model used by the site administrator in Shanghai is identical to the one described earlier: reverse proxy combined with an account pool, bulk registration and purchase of Claude and GPT accounts, automated account maintenance, proxy servers hosted overseas, and advertising “1 yuan for millions of tokens” at rock-bottom prices, then reselling the APIs to domestic users. Public security authorities have classified this as suspected illegal business operations, with an alarmingly low threshold for prosecution: under current standards, an illegal turnover of more than 50,000 yuan or illicit gains exceeding 10,000 yuan is sufficient to trigger a case. Compared to the monthly revenue of top-tier projects—5 million yuan—even a fraction of one month’s earnings exceeds this threshold.
This isn't something that can be dismissed with a simple “compliance matters.” The six saved compliance costs differ in nature and price, and can be categorized into three tiers based on whether they can be resolved with money.
Layer one: costs that should theoretically be solvable with money. The fixed expenses of a legitimate operator include obtaining licenses, registering with authorities, and implementing content moderation. A relay service providing cross-border information routing and data processing is classified by regulators as an enhanced telecommunications service, requiring licenses such as ICP, EDI, or IP-VPN. Obtaining these licenses is a matter of time and money—it’s achievable. But the real barrier lies in the next step: offering generative AI services to the domestic public requires prior algorithm registration and security assessment. However, resold models like Claude and GPT cannot be registered domestically under current regulations, because foreign large models fail to meet China’s requirements for content and data security. This means that as long as your source remains foreign models, the idea that “paying for licenses equals compliance” is an illusion—licenses may be obtainable, but the path remains blocked. For layer one to truly become a matter of “money solving the problem,” the prerequisite is switching your source: replace Claude and GPT with domestic models like Silicon Flow or Zhipu that have already completed registration. This switch is the master control that reduces the subsequent two layers of criminal risk to clearly defined compliance costs.
Layer two: the risk of losing money. This layer is probabilistic—losing some money is acceptable to many business owners after doing the math. The most typical cases involve false advertising and commercial confusion: claiming to offer Claude while using a different model on the backend, or borrowing official names and logos to gain credibility. There is already a growing number of actual fines on this front. In 2023, a company in Shanghai operated the WeChat public account “ChatGPT Online,” using a highly counterfeit OpenAI logo and branding itself as the “Chinese version of ChatGPT,” collecting fees from 4,231 paying members. It was fined 62,692.7 yuan by market regulation authorities under the Anti-Unfair Competition Law. This year, the State Administration for Market Regulation publicly disclosed five typical cases of unfair competition in the AI sector: one company was fined between 5,000 and 30,000 yuan for mimicking DeepSeek to promote a “local deployment tool”; another was fined 200,000 yuan for using AI outbound calling software to impersonate banks and promote loans.
According to the boss’s algorithm, this layer is quantifiable: the cost per incident ranges from a few thousand to 200,000, depending on penalties and fines; the statutory minimum fine for false advertising starts at 200,000. The likelihood of occurrence depends on how conspicuous the behavior is and whether anyone reports it. Overall, this cost is acceptable and is commonly treated as an operational expense in the industry. Lawyers can help by accurately calculating this figure and finding ways to reduce it further: avoid using official trademarks or names on promotional materials, clearly state which model is actually being used, and ensure billing multipliers are transparent and verifiable. If these three points are followed, the cost of this layer can be reduced by more than half.
The third layer is the line where money can't solve it. At this level, losses can't be fixed, because it concerns personal freedom and eligibility—the formula no longer applies. The core action of this business hits all three at once.
One is illegal business operations. Article 225 of the Criminal Law stipulates that anyone who violates state regulations and engages in other serious illegal business activities that severely disrupt market order, if the circumstances are severe, shall be sentenced to no more than five years of fixed-term imprisonment or criminal detention, and shall also or alternatively be fined one to five times the amount of illegal gains; if the circumstances are especially severe, the sentence shall be more than five years of fixed-term imprisonment. Operating value-added telecommunications services without a license is the most direct entry point for this crime. Looking back at precedents, logically consistent rulings already exist: in a paid proxy service case for bypassing internet restrictions in Taizhou, Zhejiang, Case No. (2018) Zhe 0329 Xing Chu 46, the defendant was sentenced to one year and six months in prison, suspended for two years, along with a fine; in a cross-border accelerator proxy case in Hefei, Anhui, Case No. (2018) Wan 0111 Xing Chu 885, the defendant received an actual prison term and all illegal gains were confiscated. The Shanghai AI relay station case involves actions that are fundamentally no different from these cases.
The second is violation of citizens' personal information. When users submit prompts and context, intermediaries can see and retain all of it during forwarding. In the industry, it has long been common for intermediaries to bundle and sell this data to model developers for training purposes. Doing so violates Article 253-1 of the Criminal Law, which stipulates that selling or providing citizens' personal information to others under serious circumstances shall be punished with no more than three years of imprisonment or criminal detention; under particularly serious circumstances, the punishment shall be between three and seven years of imprisonment.
The third point is the most hidden, concealed within a selling point that appears most like a compliance advantage: the ability to issue corporate invoices. Enterprise customers need invoices for accounting purposes—it’s a necessity, and many grassroots intermediaries advertise “corporate invoicing available” as a key feature. But the problem is that overseas APIs cannot obtain China’s VAT input tax credits; you have no genuine input invoices, yet you issue output invoices to downstream parties. This constitutes issuing invoices inconsistent with actual business operations under the Invoice Management Regulations. If the amount reaches the criminal threshold, it falls under Article 205 of the Criminal Law: the crime of falsely issuing special VAT invoices, carrying a minimum sentence of three years, three to ten years for large amounts, and over ten years up to life imprisonment for massive amounts. In a case investigated by Xi’an tax and public security authorities involving a fake online freight platform, the core issue was an intermediary issuing large volumes of invoices without any real underlying business—the ringleader has already been arrested. Invoice issuance capability itself is not a moat; if mishandled, it becomes a knife handed directly to you.
Now add these three layers back to the earlier accounting. The 50% gross margin must be multiplied by the probability of getting caught, then subtract the total potential forfeiture of illicit gains, and further subtract the loss incurred when the business instantly ceases upon arrest—most people find the result negative. Among the three layers, the second can absorb losses, but the third cannot; the first is the most nuanced—it should be a definite cost of paying for permits, yet as long as the product remains based on an overseas model, spending money and obtaining permits still leaves the path blocked. When stacked together, all three layers point to the same action.
For this business to be viable, there is only one path: move the actions from across the line to within it. Source the inventory from official enterprise procurement instead of from subscription accounts violating terms; replace unregistered overseas APIs with domestically registered models for B2B intermediation; issue invoices based on legitimate procurement, ensuring data never leaves the country, is never stored, and never resold. After making these changes, gross margins drop from 50% to 20%, but for the first time, it becomes a business that can last. If these changes cannot be made, it’s not a business—it’s just a summons waiting to arrive.
Switching to domestic models is another, more crowded business.
Swapping in a domestic model can bring criminal risk back down to compliance costs, but it’s like moving from a dead-end street into an even more crowded room.
At this level of domestic models, supply is readily available, and players are already engaging in price wars. Platforms such as Silicon Flow, Zhipu, Alibaba Cloud’s Bailian, Volcano Engine, and DeepSeek—many already registered—are competing on per-token pricing. Even the “water sellers” are bleeding: Silicon Flow is pushing its “Token Factory” narrative toward a Hong Kong IPO, yet its financials show increasing losses and heavy asset burdens.
More problematic is that big corporations are both your suppliers and your competitors. Giants like Alibaba Cloud, Volcano Engine, and Tencent, which already have their own MaaS platforms, are directly selling tokens at even lower prices and issuing more standardized invoices. As one industry professional put it in Jiemian News, the big players will capture most of the market, leaving only the leftovers for small individual operators.
On this domestic front, the "channel" itself is completely worthless, because the big players are the channel. Smaller players can still hold onto the tasks that big companies are too lazy to bother with: compliance channels for specific vertical industries, private deployment, bundled services combining invoice accounting and data compliance, and dedicated after-sales support. The nature of the business here shifts—from selling cheap tokens to selling compliance and services—slimmer profits, but longer-lasting sustainability.
There’s another path: flip the direction. Domestic models have cost advantages in computing power and electricity, enabling overseas users to leverage domestic models—exporting rather than importing—thus bypassing the two deadlocks of domestic filing and data cross-border transfer. Among the Shanghai site operator’s peers, some have already pivoted to exporting domestic tokens. But that’s a different business, another article’s topic.
Who holds the cards should step back.
The same reverse proxy, in different hands, is entirely two different things. The difference isn’t in the technology—it’s in whether you hold those cards.
If you already hold a value-added telecommunications license, have cloud distribution channels, and a licensed company entity capable of issuing invoices, this business is essentially a gift to you. The compliance barrier others must overcome costs you nearly nothing—you can immediately operate at the highest level of compliance: official wholesale with open invoicing to businesses, serving as an enterprise intermediary for pre-registered domestic models. Your profit margin may be halved, but those 92 competitors who only set up shell companies can’t even enter your door. At this point, compliance is no longer a cost—it’s a barrier.
If you have a batch of enterprise clients but haven’t yet obtained the necessary licenses and registrations, don’t rush to launch—wait for two signals. First, wait until your own value-added telecommunications and algorithm registration certificates are officially in hand; launching before then is like the Shanghai site operator’s 37-day ordeal. Second, wait until this round of special rectification has cleared out a significant portion of the gray-market players—only then will the trust premium for compliant channels become apparent, making entry far more advantageous. Your resources align perfectly with this business; you’re just one document away—it’s worth waiting for.
The worst people to be doing this are those with no qualifications, no channels, and no enterprise clients—only someone who cobbles together a botnet using open-source frameworks. Take a close look at the odds: the upside is a sliver of spread that can be wiped out at any moment by upstream actors; the downside is Article 225 of the Criminal Law, with a prosecution threshold as low as 10,000 yuan in illicit gains—and the first person in this space has already been detained for 37 days. The compliance costs you save are mortgaged against your freedom; every lever you hold—botnet, accounts, open-source frameworks—belongs to someone else, and a single move from upstream can render them worthless. This isn’t about morality or “don’t do it because it’s illegal”—it’s a negative expected value calculation.
Back to those three celebrities. This business won’t become legitimate because the Trump family entered, won’t become transparent because of Sun Yuchen’s blockchain narrative, and won’t be worth it just because Fu Sheng offers an 85% discount. What they’re really selling is something else—coins, listing stories, a political ticket. Whether their middleman business makes money or not doesn’t matter to them.
The only person who truly bet everything on this business itself was the individual site operator who built up the account pool with real money, hoping to turn things around with a 50% gross margin. Of that 50% gross margin he risked, 30% was essentially the price of criminal exposure.
Original author: Lü Yinghui