CrofAI Exposed as Fraudulent OpenRouter Wrapper Before Deleting Online Presence
AI inference provider CrofAI was exposed for secretly routing user API requests to cheaper LLM models via OpenRouter while charging markups of up to 20x. Following the disclosure and accusations of wire fraud, the owner repeatedly changed stories before completely erasing the service's website, social media accounts, and online community. This incident exposes significant trust and security vulnerabilities in the AI API reseller ecosystem, where malicious actors can obscure backend endpoints to deliver downgraded responses. It serves as a strong cautionary tale for developers seeking extremely cheap tokens from unverified providers claiming proprietary optimization breakthroughs. Investigations revealed that requests for premium models like Kimi K3 were secretly dispatched to GLM 5.3 Flash via OpenRouter, and CrofAI's claimed proprietary 'greg' model family was entirely fabricated. Furthermore, technical assertions made by the founder were proven physically impossible, such as claiming to run an ~802GiB model quantization on rented server clusters maxing out at 765GiB VRAM.
## BACKGROUND
LLM inference providers host open-weight or proprietary AI models on GPU clusters, making them accessible to developers via standardized APIs charged per token. Aggregators like OpenRouter provide a unified gateway that routes requests to hundreds of backend model endpoints offered by various hosting platforms. Because standard API interfaces hide the underlying infrastructure, users must trust that providers are serving the exact model requested.