Anthropic counted 189.9 million distillation exchanges across five Chinese labs and printed no token count and no dollar figure. At the Opus card the campaign is worth between $5.7M and $40M, and every Kimi request Moonshot relayed to Opus would have lost 40 cents on the dollar if anyone had paid for it.

Five counts, one unit, no total

Each lab's section in the report ends with an italic line of the form "Scale of distillation attacks attributable to [lab] [window]: over [N] exchanges observed." The report says seven labs; five get a count. The windows are different lengths, the counts are floors, and nowhere does Anthropic put the five in one sentence. TechCrunch wrote "nearly 200 million"; the arithmetic says 189.9 million. Here they are side by side, with what each section says the traffic was for.

The unit matters. An "exchange" is a request and a response, and Anthropic does not say how long either was. The February disclosure, which counted over 150,000 for DeepSeek, over 3.4 million for Moonshot and over 13 million for MiniMax across about 24,000 accounts, used the same unit and had the same gap. Between the two documents the disclosed volume went from 16.55 million to 189.9 million, 11.5x, though the windows do not line up and Alibaba, which is 79.5% of the new total, was not in the first one at all.

One more number that is in the report and worth holding onto: Alibaba's campaign "peaked at nearly 3 million exchanges per day." OpenRouter's chart for Claude Opus 5 shows 16,816,241 requests in the week to September 13, which is 2.40 million a day. Alibaba's peak, by Anthropic's count, was a quarter larger than every Opus 5 request OpenRouter carries today.

The version does not change the price

The report names Opus 4.6 and 4.7 for Alibaba, Opus 4.8 for Zhipu and just "Opus" for Moonshot and DeepSeek, which would be a problem for pricing except that Anthropic's pricing page lists Opus 4.5, 4.6, 4.7, 4.8 and 5 on five rows with one set of numbers: $5.00 per million input tokens, $6.25 to write a cache, $0.50 to read one, $25.00 output, and half of all that in batch. Whatever Opus a given exchange hit between March and July, it billed the same. So the only thing we have to assume is the shape of an exchange, and we would rather assume it three ways in the open than once in a footnote.

The middle row is the only one anybody measured, and it is a measurement of the wrong traffic: OpenRouter's Opus 5 requests are coding agents with 84% of their input served from cache. Distillation traffic, as the report describes it, is short fixed prompts with long reasoning answers, which is the third row, and the third row costs seven times the first. Uncached, the measured shape would be $0.399 an exchange and more than three times the cached figure, so the caching assumption alone swings the total more than the difference between labs. We carry all three rows through. Pick the one you believe.

$5.7 million, $23.8 million or $39.9 million

Two ways to look at the middle column. TechCrunch's September 11 piece on Moonshot's revenue puts Anthropic's run rate at $65 billion a year, which is $7.42 million an hour. The entire disclosed campaign, at the measured shape, is 3.2 hours of Anthropic's revenue; at the reasoning-dump shape it is 5.4 hours; at the short shape, 46 minutes. Whatever the training value of 190 million Opus transcripts is to the labs that took them, and we have no way to price that, the retail value of the tokens is a rounding error to the company that sold them.

Except that it did not sell them, which is the second way to look at it. The report is explicit that the accounts were "created with stolen credit cards, login credentials, and API keys," that Alibaba's first pool used "residential proxies, disposable emails, and virtual-card payments," and that some of the stolen API credentials belonged "to legitimate companies or individuals." The dollar column is a counterfactual. It is what the traffic would have billed if it had been honest, and honest traffic from a Chinese-controlled entity has been off the table since Anthropic's September 4, 2025 restriction on anyone more than 50% owned from an unsupported region. What Anthropic actually lost is the compute, plus whatever chargebacks came through on the cards, and it publishes neither.

Kimi K3 is Opus times 0.6, to the cent

Here is the relay in the report's words: "In one instance, over a ten-day period, Moonshot relayed almost 300,000 customer requests to Anthropic, the vast majority of which were routed to Opus." That is 30,000 requests a day. The customers "thought they were using a Kimi model, but received responses from Claude instead," and Moonshot "captured and saved at least a portion" of the exchanges for training. The report does not say whether these were API customers or app users, and it does not say when in May to July the ten days fell. We priced it both ways.

We noticed the K3 column while building this table and went back to Moonshot's Kimi pricing page to make sure. $3.00 is 0.6 of $5.00, $0.30 is 0.6 of $0.50, $15.00 is 0.6 of $25.00, and both cards discount a cache hit to 10% of input. Because the ratio is the same on all three lines, it survives any token mix: a K3 request bills 60% of the identical request on Opus, whether it is a one-line chat or a 60,000-token cached agent turn. Which means a Kimi K3 API customer whose request was quietly sent to Opus paid Moonshot $0.0752 for something that would have cost Moonshot $0.1253 at Anthropic's list price. Forty cents lost on every dollar, on every request, by construction.

The K2.6 column is there because of a date. Kimi K3 went on sale on July 16 and the relay window is May to July, so for most of it the model a Kimi customer thought they were paying for was K2.6 or K2.7 Code, at $0.95 and $4.00. On that card Moonshot would have been selling $0.1253 of Opus for $0.0267, 21 cents on the dollar. There is no rate at which relaying Opus to a K2.6 customer is a business, and no rate at which relaying it to a K3 customer is one either. The economics only close if the Opus side costs nothing, and the report's explanation of how it cost nothing is the 5,380 accounts. The value Moonshot was after was never the margin on the request; it was the transcript that came back, which it kept, and which the report says it fed to a "CoT extraction pipeline."

If the customers were app users instead, the arithmetic gets worse for the customer and stays impossible for Moonshot. Kimi's consumer tiers run from $19 a month to $199, and the $99 Allegro tier is the cheapest whose row mentions "K3 extra-long chat capacity (up to 1M tokens)." A subscriber at 30 requests a day on the measured shape is $112.80 a month of Opus at list, on a $19 plan. Either way, the report's example of who was on the other end is "[a]n engineer at a major PRC SOE" who "revealed internal code and live credentials from multiple major PRC companies" and "had no way of knowing that their use of Kimi was being forwarded to Claude."

What the distilled models sell for

This is the part of the story that lands on a pricing site. Anthropic says the Alibaba transcripts went "into Qwen 3.5, 3.6, and 3.7," that Moonshot's went "to train its models," that Xiaomi's were "for both SFT and RL," and it does not name a Kimi, DeepSeek or GLM version. We are not going to either. What we can do is put each lab's current flagship card next to the card it was allegedly drawing from.

MiMo-V2-Pro is on this list for a specific reason. The report says Xiaomi "may have launched its MiMo-V2-Pro model with a free trial period" that was "then extended" and did so "with the intent to use the surge in international developer use of the model to distill Claude capabilities," and that "[t]he bulk of the distillation attacks on Claude began just as the trial period was ending." A free tier as a transcript-collection device is a pricing decision, and it is the first time we have seen one described that way in a document like this.

One more data point landed the same day as the report. Cognition released SWE-2 on September 10, "post-trained from Kimi K3," and its headline claim is that on FrontierCode 1.1 it lands "within one point of Fable 5.1 while being 64% cheaper." The footnote gives Fable 5.1 Medium at $3.28 a task, which puts SWE-2 at about $1.18, and there is no API and no rate card, just Devin. So the chain now runs Opus transcripts, by Anthropic's account, into a Kimi base, into a Cognition post-train, sold as a per-task saving against Anthropic's own flagship. We are not in a position to say how much of K3 came from Claude. Neither, on the evidence of its own report, is Anthropic, which is why the document counts exchanges and not benchmark points.

What it changed for people who pay

The last two pages list the countermeasures, and three of them are things a paying developer will have felt. "Claude now summarizes its internal reasoning before responding," which is why you get a summary block and not the trace. "[W]ith Fable 5.1 we introduced preserved thinking, which stops new API accounts from altering the system prompt, tools, or messages that precede Claude's reasoning in multi-turn conversations," because "editing the context before it is a common technique attackers use to make Claude reveal it." And accounts that trip abuse signals, including "operating from unsupported countries like China, Russia, and Iran," can be made to verify identity or be banned. The mechanism Moonshot and DeepSeek used, saving the thinking signature and replaying it in a fresh session until Claude "convert[ed] the reasoning signature back into the full reasoning trace," is the one preserved thinking is built against.

None of this moved a price. Opus is $5 and $25 today, as it was in March. What moved is the product, and the reason is in a table that bills by the exchange.

Seven blanks in a 154-page report

• A token count, for any lab, in either the February or the September document. Every dollar figure above is ours.
• Which Opus the Moonshot and DeepSeek traffic hit. The report says "Opus"; the card is the same for 4.5 through 5, so it does not change the arithmetic, but it would change the story.
• Whether the 300,000 relayed requests came from API customers or app users, and which ten days they fell on.
• Whether any of the 5,380 accounts paid a real invoice. The report's language is stolen and virtual cards; it does not say all of them were.
• A response from Moonshot. CNBC says none of Alibaba, Moonshot, DeepSeek or Xiaomi "immediately respond[ed]" to its requests for comment, and we found nothing since. Moonshot's only statement in the window, on September 12, denied a rumour that its founder had been detained and called it "completely fabricated and malicious slander."
• A response from Alibaba, DeepSeek, Zhipu or Xiaomi. China's commerce ministry said on September 9 that distillation is "a normal technical and commercial issue in the AI industry," but that was a reply to the September 8 NSA, FBI and CISA advisory, not to Anthropic.
• The terms of the MiMo-V2-Pro free trial the report describes. Xiaomi's model page carries the $1 / $3 card for up to 256K and $2 / $6 above it, and nothing about a trial.

The Hacker News thread had 184 points and 243 comments when we checked, and the top-voted reply on the second thread was a version of "Claude took the whole internet, so what." That is an argument about ethics and we are not having it here. The argument we can have is that a report about tokens should say how many, and this one does not.

Where each number came from

• Anthropic: Detecting and countering misuse of AI: September 2026 - September 10, 2026. Distillation section pp. 143 to 154 of the full report PDF. Every per-lab count, account count, quoted sentence and countermeasure above
• Anthropic: Detecting and preventing distillation attacks - February 23, 2026. Over 150,000 exchanges for DeepSeek, over 3.4 million for Moonshot, over 13 million for MiniMax, about 24,000 accounts
• Anthropic: Updating restrictions of sales to unsupported regions - September 4, 2025. The 50% ownership rule and its distillation rationale
• Anthropic: Claude pricing - Opus 4.5, 4.6, 4.7, 4.8 and 5 at $5 / $6.25 / $0.50 / $25, batch half, read September 14
• Moonshot: Kimi API pricing - kimi-k3 at $3.00 / $0.30 / $15.00, kimi-k2.6 at $0.95 / $0.16 / $4.00, kimi-k2.7-code at $0.95 / $0.19 / $4.00, read September 14
• Kimi: Membership pricing - Moderato $19, Allegretto $39, Allegro $99, Vivace $199 a month
• OpenRouter: Claude Opus 5 - 16,816,241 requests, 1,218.7B prompt tokens of which 1,022.4B cached, 24.58B completion tokens, September 7 to 13, read from the model chart on September 14
• OpenRouter: Kimi K3 - 24,771,456 requests and 1,448.1B prompt tokens in the same week, about 210B tokens a day
• Alibaba Cloud: Model Studio pricing, DeepSeek pricing, Z.ai pricing - Qwen3.8 Max $2 / $6, DeepSeek V4 Pro $0.66 / $1.98 off-peak, GLM-5.3 $1.40 / $4.40, read September 14
• Cognition: SWE-2 - September 10, 2026. "Post-trained from Kimi K3"; 50.0% on FrontierCode 1.1 Main; "within one point of Fable 5.1 while being 64% cheaper," with Fable 5.1 Medium footnoted at $3.28 a task
• TechCrunch: Anthropic details distillation campaigns and Kimi maker Moonshot AI targets $2 billion in annual revenue - September 10 and 11, 2026. "Nearly 200 million"; a $2 billion target that is "double the company's reported revenue run rate for August"; Anthropic at $65 billion
• Moonshot's September 12 statement - The detention rumour denial, the only Moonshot statement in the window
• China.org.cn: MOFCOM on the US advisory - September 9, 2026. Distillation "a normal technical and commercial issue in the AI industry"
• Hacker News: Anthropic threat report - 184 points, 243 comments at the time of writing