How B300 Servers Reached China: The Transaction Chain Behind 74 Machines

On August 24, 2026, the Keelung District Prosecutors Office in Taiwan disclosed a case involving an order for 130 advanced AI servers. Prosecutors allege that 74 were resold and shipped to China, while the remaining 56 did not complete export. The machines were manufactured by Supermicro and equipped with NVIDIA B300 GPUs. The unit is a server, not an individual chip, and the account represents prosecutorial allegations rather than findings established by a court. Keelung prosecutors, August 24, pp. 2–6

The case provides a concrete answer to part of the question of how B300 equipment reached China. The transaction began with an order declaring that the servers would be used in Taiwan. It involved a server manufacturer, distribution and trading businesses, and people connected with data-center services. Prosecutors allege that participants concealed the actual customers and purpose, obtained the manufacturer's sales approval, and subsequently diverted the equipment to Chinese customers.

An order declaring that the machines would stay in Taiwan

According to the prosecutors' account, the purchaser was a technology business engaged in server trading. Documents submitted in September 2025 identified it as the end user, specified installation in Taiwan, and declared that the equipment would not be exported or re-exported to restricted parties. The manufacturer approved the order, which was delivered in three stages: two servers, followed by 64 and another 64.

That declared use conflicts with the subsequent destinations described by prosecutors. Their account includes direct exports and shipments through other jurisdictions before delivery to Chinese customers. These are historical routes disclosed in a specific case; they do not establish a universal pathway for B300 equipment.

Source: Keelung prosecutors, pp. 3–5. These are allegations about this order, not a census of the Chinese market.

Calling all such supply “offshore cloud capacity” would blur the central fact. This case concerns the physical movement of servers across borders. A team in China accessing a machine located abroad is a different arrangement: the computing service is being consumed, but the hardware need not have entered China. Each proposition requires its own evidence. An overseas cloud quotation does not demonstrate a physical import.

Nor does the case establish how many B300 systems China currently possesses. Orders identified by enforcement agencies are a selected sample. Other transactions cannot be assumed to have the same size, configurations or completion rate. The figure of 74 makes the alleged movement specific and measurable; it is not a basis for extrapolating national installed capacity.

The vulnerability spans the customer-review chain

Advanced servers are not simply purchased from an unrestricted shelf. The prosecutors describe a process that included buyer qualification, end-user and end-use review, and checks of the proposed installation site. Those steps were intended to establish both that the buyer needed the equipment and that it could operate the machines where it said it would.

The physical mismatch is important. Prosecutors allege that the declared facility lacked the rack space, electricity and network conditions needed for 130 advanced AI servers, and that these shortcomings were concealed during the review. The manufacturer's understanding of the site depended on information passed through people involved in the transaction and inspection. Keelung prosecutors, pp. 2–3

The implication for supply-chain analysis is straightforward: complete paperwork and genuine end use are different tests. A registered address, an executed contract and the existence of a data center do not individually establish that equipment will run there over the long term. Order size must also be consistent with the customer's business, financing and facilities.

Responsibilities are divided in ordinary commerce. Manufacturers ship, distributors collect payment, operators provide facilities, and logistics businesses transport goods. Each party completing its assigned function does not ensure that anyone has reconciled the entire chain. The customer accepted at one stage may not be the beneficiary served at the next.

NVIDIA's quarterly filing for the period ended July 26, 2026 states that it lacks physical control over products after sale and relies on customers and partners' compliance processes. This describes a limit on direct control, not the absence of review responsibilities, and it does not exonerate any particular transaction. NVIDIA FY2027 Q2 Form 10-Q, Export Controls, p. 38

Who bears the capital-recovery burden of a RMB12 million server?

Shipping records help establish where equipment went. Financing and proceeds help explain why a transaction could attract participants in the first place.

Market reporting adds a separate reference point. CNA's account of an April 30, 2026 Reuters report cited four industry sources putting B300 servers in China at about RMB7 million each. Two sources separately put a server with eight B300 GPUs at roughly $550,000 in the United States. Those are dated interview-based prices, not September quotations or matched prices for the machines in the Taiwanese case. Reuters reporting via CNA, April 30

A higher figure subsequently appeared in public commentary. On July 2, Zhang Zhaoye wrote on Eastmoney's user-contributed Caifuhao platform that mainland B300 server transactions had reached RMB12 million per machine. The post did not supply a specific system configuration or transaction documentation. It establishes a published market claim, not a verified prevailing transaction price. The two figures do not form a like-for-like price series. Caifuhao post, July 2

An explicit stress scenario makes the operating implications clearer. Assume an eight-GPU server costs RMB12 million, with its hardware purchase recovered over five years and no residual value. Annual hardware capital recovery would be RMB2.4 million. If 70% of the year's 8,760 hours are billable, the hardware alone requires approximately RMB48.9 per billable GPU-hour: 12,000,000 / (5 × 8 × 8,760 × 70%). This is not a rental quote, an accounting depreciation policy or an observed payback forecast. It excludes financing, electricity, facilities, networking, maintenance, taxes and profit, as well as failure and obsolescence risk.

At an assumed RMB7 million purchase cost, with everything else unchanged, the equivalent requirement is approximately RMB28.5 per GPU-hour. The RMB20.4 difference must be absorbed through higher customer pricing, higher billable utilization or lower other costs. An increase in equipment prices therefore does not automatically expand a compute lessor's profit. Customer willingness to pay is the missing bridge.

Over the next six to twelve months, the useful test is whether delivered prices for comparable systems align with renewal rates, cash collection and billable utilization. Persistent equipment premiums alongside falling renewal rates would pressure capital recovery on expensive installed assets. Sustained customer payments and stable utilization could support the economics instead. An isolated equipment quotation cannot establish which scenario is unfolding.

Prosecutors allege that a distributor advanced money for the purchasing entity, concealing the actual funding source. They state that, after reselling the 74 servers and deducting payments for the goods to the distributor, two people obtained combined unlawful proceeds of $21,205,531. The release separately describes sales-related bonuses and allegations involving misappropriation of distributor assets. These amounts have different meanings and should not be aggregated into a single measure of chip-trading profit. Keelung prosecutors, pp. 2 and 5–6

Dividing the alleged proceeds by the number of resold servers gives an Atlas calculation:

$21,205,531 ÷ 74 servers ≈ $286,561 per server.

This is a simple average of proceeds after the stated goods payment. It is neither the selling price nor net profit calculated after every cost. The public record does not disclose sufficient per-unit prices and complete expenses to calculate a reliable net margin. The result also cannot stand in for an average premium across China.

It nevertheless identifies a substantial incentive to obtain purchasing access, organize financing and complete a resale. Atlas interprets the spread as potentially reflecting scarcity, delivery risk and intermediary bargaining power together. The case alone cannot isolate the contribution of each factor.

For a downstream operator, the purchase premium is only one component of risk. Advance payments, delivery dates, title to the asset, support and follow-on procurement all affect the eventual cost. A provider promising continuous compute services can lose the benefit of superior hardware if unavailable repairs or replacements create downtime and contractual liabilities. Its asset must support repeated delivery, not merely switch on once.

B300 has a specific technical appeal. NVIDIA's Blackwell Ultra architecture description lists up to 288 GB of HBM3e capacity per GPU and 8 TB/s of memory bandwidth. In long-context and concurrent inference, memory accommodates model parameters and the intermediate state associated with requests. Capacity, data movement and processing capability jointly constrain throughput. NVIDIA Blackwell Ultra architecture

For some workloads, additional memory may reduce the need to split a model or move data, allowing fewer cooperating nodes to perform a task. The saving depends on numerical precision, context length and concurrency. A universal performance multiple divorced from those conditions cannot explain actual willingness to pay.

Customers may also value completing development, validating a model or delivering a service sooner. That possible time premium helps explain why short-term demand could tolerate high acquisition costs. It does not identify what the customers in this case actually ran: their workloads are not disclosed in the public account.

A separate U.S. case broadens the comparison

In March 2026, the U.S. Department of Justice announced a separate case concerning alleged AI-server diversion. Prosecutors described approximately $2.5 billion in server purchases by a Southeast Asian business during 2024–2025 and alleged concealment of Chinese end customers in the scheme. For the specific period from late April to mid-May 2025, they alleged diversion to China of servers worth at least approximately $510 million. The announcement emphasizes that the accusations are charges and that defendants are presumed innocent unless proven guilty. U.S. Attorney's Office, Southern District of New York, March 19

The cases are comparable in structure, not additive in size. The $2.5 billion is the procurement figure described in the U.S. case, not B300 sales into China. It cannot be combined with the Taiwanese case's 74 machines. The U.S. announcement does not provide a product breakdown establishing that all the equipment was B300.

The shared concern is an alleged separation between the purchasing entity and the ultimate beneficiary. It moves the analysis upstream from transportation: did the order represent real demand from the declared customer, could that customer support its size, and did sales incentives compromise independent review?

Individual allegations do not establish company-directed conduct. On August 20, Supermicro released the results of an internal investigation concerning the U.S. case. It said the review found no evidence that current senior management knew of the alleged diversion, noted that the company was not named as a defendant in that indictment, and described personnel measures and compliance improvements while continuing to cooperate with authorities. Supermicro investigation announcement, August 20

That is the result of a company-commissioned investigation, not a judicial ruling. Its scope cannot automatically be extended to every allegation Taiwanese prosecutors disclosed four days later. Responsibility must be assessed separately for each case and party; the available evidence does not justify turning allegations against individuals into a claim of organized corporate supply to China.

H200 licenses do not explain B300 provenance

Licensed sales and alleged unauthorized diversion must be analyzed separately. Even within one order, commercial approval and government export authorization are different controls.

Buyer qualification and order approval in the Taiwanese account concern the manufacturer's sales process. They do not replace a government export license or authorize subsequent changes in use. Prosecutors state that the final 56 machines were required to obtain a strategic high-technology commodities export license and did not complete export. Commercial approval was therefore insufficient to carry the remaining equipment through the export process. Keelung prosecutors, p. 4

NVIDIA's latest quarterly filing reports limited H200 shipments to specific Chinese customers under U.S. government licenses, accounting for less than 1% of quarterly Data Center revenue. That is a disclosure about a particular product and authorized transactions. It cannot be generalized to B300. NVIDIA FY2027 Q2 Form 10-Q, pp. 27 and 37

An overseas purchase is not inherently outside the rules either. In guidance dated May 31, 2026, the Bureau of Industry and Security explained that existing licensing requirements for relevant advanced-computing items continue to apply to entities headquartered, or whose ultimate parent is headquartered, in specified restricted jurisdictions, even when the entity itself is elsewhere. The guidance also discusses continued operation by bona fide compliant data-center operators. BIS guidance, May 31

Reporting must distinguish where a machine sits, who owns or controls it, and who consumes its computing services. Those answers can point to different places and different licensing, contractual and data obligations. A Chinese customer does not alone demonstrate a physical import; an overseas facility does not alone establish that the entire arrangement is compliant.

The distinction affects supply estimates. Additional domestic assets require evidence of delivery, installation and acceptance. Additional offshore services require evidence of the provider, deployment location and rights of access. Combining them into an imported-GPU total overstates the domestic fleet while obscuring service-contract risk abroad.

Arrival is only one milestone toward usable compute

B300 names a GPU product; servers built around it can have different configurations. DGX B300 is NVIDIA's own system, while GB300 NVL72 is a different rack-scale product. Seeing “B300” does not identify either a complete GB300 rack or a standardized server configuration. NVIDIA Blackwell Ultra systems announcement, March 18, 2025

As a technical reference, NVIDIA's DGX B300 user guide specifies eight GPUs and maximum system power of 15 kW. That illustrates the demands on electricity and cooling; it is not measured consumption for the Supermicro machines in the Taiwanese case. Model, workload and cooling configuration matter, so the figure cannot simply be multiplied into a facility-capacity estimate for those shipments. NVIDIA DGX B300 user guide, updated September 8

Delivered servers still need power, cooling, networking, storage, drivers and scheduling to work together. For training, communication between nodes and recovery from failures affect productive time. For inference, latency, request patterns and utilization influence cost per unit of revenue. The equipment list describes an input; completed work is closer to the output that customers buy.

A useful operating framework is to consider hardware capability, available running time and the degree to which a workload uses that capability. There is no universal efficiency discount: different models, clusters and operating teams must be measured separately. Multiplying theoretical peak processing power into revenue skips the interfaces where usable output can be lost.

An operator's claim to own B300 equipment is therefore a starting point for investigation. Continuous operating records, customer acceptance, support obligations, asset ownership and revenue recognition are more informative together. Missing records neither prove that a machine is counterfeit nor justify counting it as dependable commercial capacity.

The next contest is over repeatable supply and service

The case could easily become a sweeping claim that controls have failed completely. Yet the 56 machines that did not complete export belong to the same evidence set as the 74 allegedly diverted. Both outcomes matter: the record describes alleged breaches and a practical limit on completion.

Over the next six to twelve months, Atlas expects buyers to face a question more consequential than whether isolated machines appear for sale: can they procure again on consistent legal and commercial terms and continue receiving support? One delivery may satisfy a short project. A multi-period compute commitment requires spares, expansion and sustained operations. Discontinuous supply can transmit risk into customer contracts and cash flow.

This view is testable. Repeated, licensed and traceable deliveries of the same equipment with complete support would reduce supply uncertainty. Further retained orders, delivery delays or support restrictions would strengthen the concern, potentially affecting prepayment requirements, contract duration and fulfillment terms. Either development requires evidence; a single case cannot determine the outcome in advance.

For domestic accelerator suppliers, the competitive opportunity consequently extends beyond theoretical peak performance. Reliable availability, local support and migration costs all affect customer choice. Supply risk around B300 does not establish equal task efficiency elsewhere. Substitution must be demonstrated through workloads, completed deliveries and repeat customers.

For data-center and compute-service operators, the alignment of asset provenance, operating capability and customer obligations is central to business quality. Expensive machines that cannot support a long-term commitment may generate less cash than less capable equipment with dependable supply. That is the case's most direct infrastructure implication.

The public record supports a bounded answer: Taiwanese prosecutors allege that B300 servers entered a commercial chain under declared Taiwanese end use and were subsequently resold and shipped to China. The final customers' full identities, deployment sites and operating results are not disclosed. The case reveals a specific channel, not the entire Chinese B300 market.