How to read this
This is the full initial research corpus behind Kairos: Asymmetric Unit. An orientation sweep, not a claim to completeness. Nothing here is polished for persuasion — it is the working state of what we actually know, believe, and have already been wrong about.
Three rules govern every line on this page:
- Every claim wears its confidence. A number without a source label is a rumor wearing a suit. Hover any badge for what it means.
- Everything we killed stays visible. The graveyard below is not humility theater — it is the proof that the machine attacks its own conclusions before it brings them to you.
- Your internal figures are deliberately not printed here. This page sits on the open internet. Numbers you shared verbally are treated as unverified until the first data pull, and stated only in shapes (ratios, directions) — you hold the exact values already.
verified public registry insider · unverified n=1 hypothesis killed
The facts board
The current state of what we hold, after two red-team passes. Where a fact conflicts with itself across MN's own surfaces, the conflict is the finding.
| Fact | What we hold | Confidence |
|---|---|---|
| Revenue shape | ≈90% VPN subscriptions, declining · ≈10% GoProxies, growing ("2nd best month"). The decline rate we saw covers one month — the 12-month series is the single most important pull. | insider · unverified n=1 |
| Treasury & burn | Known to you; our copy is verbal, single-channel, unverified — including whether the treasury is fiat or crypto, who legally owns it, and who can authorize its use. Figures deliberately not printed here. | insider · unverified |
| The entity map | BlockDev AG (Zug, protocol) · UAB MN Intelligence (FY2025: €1.13M revenue, −€268k, 13 employees; runs VPN, schema-tagged on GoProxies) · UAB MN Technologijos · NetSys Inc. (Panama; MystNodes operator). Which entity legally contracts GoProxies — and the intercompany economics — still open. | registry |
| MYST token | ~$0.09 · ~$2.9M cap · ~$30k/day volume · MEXC-led · no Binance; −98% from ATH. One hundred times smaller than Grass on both cap and nodes. | verified public |
| The node fleet | Conflict: ~22k active (mothership) vs 31,547 IPs / 135 countries (MystNodes landing) vs 32,570 / 182 countries (dashboard). The counting bases don't reconcile — and the 182-country breadth claim rests on which one is true. | verified public unresolved |
| Team | ~26–28 visible on LinkedIn vs "~40" said internally; hiring frozen (empty Workable). | verified public insider |
| GoProxies | In-house product with its own sales team. Pricing $2.40/GB entry → $1.40/GB at volume; self-serve checkout live (card + crypto); Scraping API in private beta. But: 80M+ advertised IPs cannot be MN's ~22–31k nodes — the supply mix (own network vs upstream resale) is unmapped, and it decides what "scaling GoProxies" even means. | verified public supply open |
| Node-runner risk | Only exposed residential operators earn meaningfully; datacenter earns near zero. Home raids documented (Germany, July 2025; 15 years of Tor-operator precedent). Terms route liability to the operator. Low-probability, catastrophic-severity. | verified public |
| Content engines | Four run unlinked: near-daily VPN news desk · GoProxies research arm (with press pickup) · thin MystNodes blog · dead legacy blog. The mothership links none. Fragmentation, not silence — and the one consistent engine aims at the declining product. | verified public |
| The market | Bright Data ~$300M ARR, +50% YoY, serves 14 of 20 LLM labs · Oxylabs $43.7M ARR, 397 people, Vilnius, bootstrapped · Grass ~100× MN's cap and nodes · Tesonet group >€1B revenue, same two markets, same city. The money is real. So is the competition. | verified public |
What we killed
Between July 3 and July 18, roughly half of what we believed died — killed by our own adversarial passes, not by events. Each corpse below is a mistake that never reached your boardroom. This section is why you can trust the rest of the page.
False — our own early claim. Direct crawl found a near-daily news desk and three more engines. The real problem is fragmentation, which is a different lever entirely.
Carrier terms forbid it, no proven trust premium exists, and Bright Data already retreated from it. Survives only as a cheap node-classification test.
It's a demand hypothesis wearing a moat costume — with adverse-selection, abuse, and procurement risk attached. Dead as a promise; alive only as a discovery question.
Category error. Network activity is proven; monetizable proxy capacity is not. Most volume is low-value VPN traffic, not premium supply.
Built on prior-year accounting unreconciled to current revenue, with burn ownership unproven. Struck from the facts board.
No precedent exists at MYST's depth. Every recovery we studied (Injective, Fetch, Helium, Render) started 50×+ bigger and rode an external narrative wave. Honest base rate: low single digits.
Vendor-dense and freshly funded — Browserbase at $300M, Firecrawl, Anchor, plus incumbent agent SKUs. Arriving late with less capital is not a wedge.
A 397-person, $43.7M neighbor in the same city. Right-to-win analysis returned: none.
Bright Data's federal court wins settled it: provenance is not a legal defense, and consent is a prerequisite, not a moat. The NetNut/Popa takedown makes provable consent operationally valuable — but that's a gate, not a wall.
A commodity race against better-capitalized players in a declining category. Not our war.
The market standardized on stablecoins and x402/L402 rails owned by giants. The real asset is 4.5 years of micropayment know-how — ride the standard, don't fight it.
One good month. No churn, margin, concentration, or supply-source data. Promising signal, not an engine — yet.
What survived
The insights that took two red-team passes and are still standing. These are the load-bearing walls.
- The money is up the stack. Raw gigabytes are a commodity; the 10–30× markup lives in managed, per-success access. GoProxies' own Scraping API beta points the same direction.
- The founding premise is the baggage. Positioned as a 2016 decentralized VPN while materially a 2026 data-supply network. The strongest unclaimed frame found: consent-provable, crypto-native bandwidth for buyers incumbents structurally can't serve. A positioning hypothesis — but the diagnosis itself held twice.
- Four waves, mistimed. Funded by the fast waves (Ethereum, ICO), needed the slow ones (privacy, DePIN) that crested after momentum died. Forward filter for every new bet: pair one fast wave with one slow structural one.
- Mysterium is a portfolio, not one business. Commercial VPN, GoProxies, node/protocol infrastructure, and the mission layer have different economics and need separate boundaries. Token holders and node runners are constituencies, not revenue lines. Break-even is meaningless until the commercial P&L and the deliberately-subsidized mission work are separated — that separation is a board-level definition only you two can make.
- The melting base outruns growth — if the decline is real. Arithmetic: even punishing proxy growth loses a year-one race against the VPN slide we saw. But that slide is one month of data. Which is why the 12-month series is pull #1, before any structural conclusion.
- Node economics are structurally contradictory. Only exposed residential operators earn, and no amount of opsec removes the exposure. Any future that leans on the node network must solve this honestly — it is also, handled right, a differentiator no botnet-adjacent competitor can copy.
- Fragmentation may be a firebreak, not just a failure. The entity and brand separation that looks like marketing chaos may be deliberate risk isolation. Resolve its purpose before consolidating anything.
- Agent traffic threads the needle. Low-volume, human-paced, decentralized trickle self-selects the premium use case and dodges the carrier-terms wall. Unvalidated — but it's the hypothesis the architecture is natively good at.
- We sell urgency, not analysis. A long runway is comfortable, and comfort has no forcing function. The unit's real product is dated decisions: every phase ends with a written continue/stop/redirect call that is yours.
- An abandoned surface is negative, not zero. Commit to a cadence or don't start — proven by MN's own portfolio of half-alive properties. We apply the same rule to ourselves.
The open questions
What we genuinely don't know yet — ranked by how much hangs on the answer. "We don't know yet" is not a gap in this proposal; it is the honest map of where the work starts.
| Question | Why it's pivotal | Status |
|---|---|---|
| Is the VPN decline fixable or secular? | The fork the whole Phase-1 plan hangs on: stabilize the base vs controlled contraction into the growth line. | open · pivotal |
| Where does the commercial business end and the mission begin? | Break-even can't be defined — let alone reached — until the deliberately-subsidized mission work is ring-fenced from the P&L that must carry itself. | board-level |
| What is GoProxies actually made of? | Supply source, consent chain, transfer price, and margin per SKU. If it mostly resells upstream supply, "scale GoProxies" is a standalone margin business, not network monetization — a different (not necessarily worse) story. | open · gate |
| Treasury: owner, mix, authority? | Every capital-allocation option — including buying revenue instead of growing it — is imaginary until ownership, liquidity, and decision rights are documented. | unverified |
| Which node count is real? | The 135-vs-182-country conflict decides whether geographic breadth is a genuine advantage or a stat artifact. | unresolved |
| Crypto-native, no-KYC demand — real buyers, at what quality? | The one space incumbents structurally can't enter. But no-KYC also invites the exact abuse that destabilizes supply — discovery must answer both sides. | discovery |
| Is ideology the revenue ceiling? | The origin story may be capping monetization. Proton is the structural precedent that mission and margin can coexist — the question is what it costs here. | load-bearing |
The four must-pulls, day one: real burn with breakdown and decision rights · the 12-month VPN cohort/churn series · GoProxies contribution economics by SKU and customer · the entity/intercompany map. Everything above unblocks from these four.
And the fifth pull isn't a document. A named money-owner with a 48-hour answer line is the floor, not the whole ask — most of what Mysterium knows is written down nowhere. It lives in the team, and it surfaces through listening access: Slack presence and informal coffee conversations, opt-in, zero meetings added.
Where we hunt
Three concentric rings. We don't know yet which holds the asymmetry — we know precisely where we're looking, and every find comes back as a proposal with a decision gate. Your call, every time.
The current company
MN's team, products, and processes: the economic perimeter, where margin leaks, and the one or two places a small move creates the biggest change. The four must-pulls live here.
The team, aimed outward
Opportunities outside the current products that MN's existing team, infrastructure, and know-how could be pointed at — in part, at first. New lines on existing rails.
Capital & network
Asymmetric opportunities that never enter the MN team — deployed through its capital and, where useful, its network. Each one arrives as a standalone proposal with its own gate; nothing is pre-authorized.
The optimism case
"Problems are inevitable. Problems are soluble." — David Deutsch, The Beginning of Infinity
Everything above is the sober half. Here is the other half, and it is not decoration: the pessimistic reading of this initial sweep is incomplete. Deutsch's argument — the one this unit operates on — is that problems yield to knowledge-creation, and knowledge-creation is exactly what a small, fast, honest unit is for. The graveyard above is not a list of losses. It is the engine running.
What the ground actually holds:
- The market is proven at €1B, from this city. Tesonet's group runs the same two markets — VPN and proxies — at over €1B a year in revenue. Not a projection: a neighbor. The question was never whether the money exists.
- A real, consented residential network in 135+ countries is rare and expensive to rebuild. The NetNut/Popa takedown just demonstrated, live, what happens to supply built the other way. MN's node fleet — with its contradictions honestly solved — is the kind of asset the industry's next chapter will need and can't easily copy.
- Nine years of protocol know-how, including 4.5 years of production micropayment rails. The standards that won (x402, stablecoins) need exactly the operating knowledge MN already paid to acquire.
- The slow waves MN needed are finally cresting. DePIN is projected to triple; the privacy-and-autonomy wave that never broke in 2017 is still building. The mistiming was the tragedy of the first act — it is also the setup of the second.
- Time is the treasury's real gift. Runway means the next move can be chosen deliberately instead of desperately — if it's paired with the forcing function it dissolved. That pairing is literally what this unit is.
- An honest map is a weapon. Most companies in MN's position are lied to — by vendors, by consultants, by their own dashboards. You are holding a document that kills its own favorite ideas in public. That discipline, compounded weekly, is the asymmetry that finds the others.
"We don't know yet" is the position of someone standing at a beginning, not at an end. Fixed targets today would be fiction dressed as rigor — and you would smell it. What we commit to instead is the machinery on this page: confidence-labeled claims, killable hypotheses, dated decisions that are yours, and the unbounded search those make safe to run.
The library
The initial corpus, July 3–23. Every document opens on request — this page is the map, not the territory.
Foundations
Research DossierJul 3
The opening deep-scan: a real, technically-alive 9-year project — ~€14.4M ICO in 45 minutes (2017), daily commits, 110 repos — with a micro-cap token, flat nodes since 2021, and Grass at 100× on both cap and fleet.
Research Program (10×)Jul 5
The self-critique that started the discipline: six falsifiable hypotheses with explicit kill criteria, and the four-phase program (X-ray → market map → alpha hunt → synthesis) the rest of the corpus executed.
Frameworks: Dunford + HROJul 13
Two lenses — Dunford (positioning) and HRO (blind spots) — one diagnosis: positioned as its 2016 self while materially its 2026 self, inside an organization whose long runway dissolved the forcing function. Self-aware caveat kept: part of the mapping is confirmation scaffolding, and says so.
Outside-in
Outside-in X-rayJul 5
The public surface, cold: a well-rated consumer VPN (4.7★, 5.1K reviews) in a commodity market, zero visible B2B/agent engineering in the top 20 repos, and a token at −98% from ATH. Two findings later corrected by the sweep — corrections logged.
Market MapJul 5–6
Eight incumbents, two newcomers, demand-side audit. Killed our own "30 desperate unserved buyers" framing; found the one structurally uncontested space (crypto-native, no-KYC) — later itself downgraded to a discovery hypothesis. Bright Data's court wins and $300M ARR anchor the ceiling.
Public-surface SweepJul 18
The corrections ledger: "blog dead" was false (fragmentation is the truth), GoProxies self-serve checkout and Scraping API beta found live, the entity map resolved from registries, and the node-stat conflict flagged as load-bearing.
Node-Economics & Operator RiskJul 17
The uncomfortable file: only exposed residential operators earn; home raids documented (Germany 2025, Tor precedent back to 2012); terms route liability to the runner; leaderboard shows mega-farmers, not thousands of homes. Low-probability, catastrophic-severity — named plainly.
Token-Reanimation PrecedentsJul 6
Every studied recovery (Injective, Fetch, Helium, Render) started 50×+ larger and rode an external wave plus shipped product. Honest base rate from MYST's zone: low single digits. Token revival demoted to a second-order effect, permanently.
Wave MapJul 17
The timing autopsy: funded by two fast waves, dependent on two slow ones that crested after momentum died. DePIN returning at 3× scale; convergence zones ranked — verified-human × privacy scored highest coherence, sitting on the original wave that never broke.
Infra AssessmentJul 17
Infrastructure is instrumental, not sacred: four genuine advantages (breadth, permissionless rail, on-chain provenance, community) — and raw bandwidth volume explicitly not among them. Its boldest claim ("5–8% to break-even") was later killed by the audit; the kill is logged in the graveyard.
Synthesis & red-team
Alpha HuntJul 6
Nineteen candidate levers generated, run through a feasibility filter (small team, ≤90 days, no head-on incumbent fights), six killed with named reasons, five survivors — and the week-one fork question that decides between branches.
Phase-1 Break-even PlanJul 17
The parametric model: even at punishing proxy growth rates, the year-one race is lost to the VPN slide we saw — if that slide is real (n=1). Produces the three-lever sequence and the fixable-vs-secular fork the open-questions board now carries.
Questions to ExcavateJul 17
The master question list, split "ask insiders" vs "investigate ourselves," ranked by leverage on the break-even path. The four must-pulls on this page are its top of stack.
30km Fresh-Eyes Audit + adjudicationJul 18
The alien-eyes pass and a second adversarial red-team, then a final adjudication of both. Found the missing balance sheet, the anesthetic of a long runway, the portfolio reframe, and the GoProxies supply gate — and struck five of our own conclusions from the record. The single most valuable document in the corpus.
Master Statelive
The living board the whole corpus rolls up into: facts with dates and confidence, an append-only insight ledger where killed ideas stay struck-through and visible, and the hypothesis board. Updated after every working session.