Kairos: Asymmetric Unit · Research layer 02

Evidence rooms.

Every compressed finding, expanded — what we believed, what we checked, what changed, and what the decision now depends on.

13 deep dives confidence labeled corrections preserved last reconciled Jul 24, 2026

The map now has doors

The research map stays compressed on purpose. This layer exists for the moment a sentence is carrying too much weight. Every room below separates the fact from the inference, keeps the correction trail visible, and ends at the decision it can actually support.

Public-safe by design. Exact insider financials, confidential documents, and person-level performance findings are not reproduced here. Their existence can shape an internal question without becoming public evidence.

13 claim families opened into evidence, limits, and action

01 · Content ecosystem

The blog was not dead.

One legacy blog was dead. The wider portfolio was publishing. The strategic problem changed from resurrection to coordination.

verified public

Original claim killed July 18 after a complete public-surface sweep.

What we first believed

The early outside-in pass saw the abandoned Mysterium mothership blog and concluded that the narrative engine had been dormant for roughly three years.

What the deeper crawl found

The conclusion was true only for the legacy surface. Across the portfolio, four different publishing systems existed with radically different cadences and jobs.

SurfaceObserved stateMeaning
Mysterium VPN newsNear-daily privacy-news publishing through July 2026.The strongest consistent engine; aimed at the declining consumer line.
GoProxies blogActive research arm; original work received outside press pickup.Evidence of B2B content competence, not a dormant company.
MystNodes blogAlive but thin; one 2026 post after a short 2025 burst.A low-cadence node-runner surface, not a reliable engine.
Legacy blogsMysterium mothership archive, old MystNodes blog, and Medium are dormant.Dead surfaces remain visible and can mislead a cold reader.

What changed again

The current mothership does link product doors. So “links none” is also too strong. The remaining fragmentation is in narrative, entity naming, metrics, and trust claims across surfaces.

Decision implication

Do not commission “a blog reboot.” First name the job of each engine, decide which product deserves the consistent cadence, and build one routing architecture without erasing entity boundaries that may serve a legal purpose.

Source trail: Public-surface Sweep, July 18 · Mysterium VPN news · GoProxies research arm · MystNodes blog · 30km Fresh-Eyes adjudication.

02 · Entity map

There is no single obvious “Mysterium P&L.”

Protocol, consumer product, node contracts, proxy storefront, treasury, and operating staff appear across several entities. Break-even is meaningless until the perimeter is chosen.

registry + public terms

The map is materially better than it was. It is still incomplete where contracting and intercompany economics matter.

What the public record supports

Four entities appear in the operating picture. Public titles and website publisher tags help, but they do not prove control over every product, treasury, or cash flow.

The discarded conclusion was that one revenue entity sat only about €22k/month from break-even. That used a prior-year loss as if it were a current monthly run rate. It was wrong.

EntityPublicly supported roleStill unknown
BlockDev AGZug entity; protocol developer and public-site operator.Treasury ownership, authority, current costs, and group control.
MN Intelligence UABStandard VPN counterparty; GoProxies publisher tags name it; FY2025 public accounts exist.Whether it invoices GoProxies customers and how intercompany charges work.
MN Technologijos UABOlder Lithuanian operating/development entity with public filings.Current staff, services, and transfers to other group companies.
NetSys Inc.MystNodes contractual operator; associated with Mysterium Dark.Its exact place in product economics and incident responsibility.

What remains unknown

Who invoices each product, who owns each cost, who can authorize treasury use, which entity bears operator incidents, and which transfers are commercial versus mission subsidy.

Decision implication

The first board choice is the perimeter: commercial operating break-even, consolidated group cash break-even, or a commercial-plus-mission model with the subsidy named explicitly.

Source trail: Swiss and Lithuanian registries · product terms · schema publisher tags · 30km Fresh-Eyes audit and adjudication.

03 · Revenue & break-even

The revenue shape is visible. The path is not.

Roughly nine-tenths comes from VPN subscriptions. A much smaller proxy line is growing. One month of movement cannot tell us whether either trajectory persists.

insider · unverified n=1

Exact internal values remain withheld from this public-safe layer.

The first model

We treated the one-month VPN decline as a continuing curve and asked whether fast proxy growth could outrun it. It could not: when the shrinking base is roughly eight times larger, the smaller line spends its first year replacing lost dollars.

The correction

The arithmetic was useful. The confidence was not. One month could be seasonality, billing failure, a price change, platform friction, or a secular slide.

QuestionEvidence neededWhat it decides
Is VPN decline fixable?12–24 months of cohorts, churn reasons, failed payments, collections, and price history.Defend the base or harvest it.
Is GoProxies repeatable?Customer concentration, churn, gross-to-net revenue, direct costs, refunds, and sales-cycle data.Prove a positive-contribution engine before adding fuel.
What is burn?Entity-scoped costs, fixed/variable split, capability dependencies, and decision rights.How far the lines must move and what can be cut safely.
What counts as break-even?A board choice separating commercial products from deliberately subsidized mission work.The target itself.

What we refuse to claim

No fixed break-even date, no “5–8% of capacity” shortcut, and no current entity-level gap derived from last year’s accounts.

Decision implication

Stabilization, contraction, acquisition, and a wedge test are four different strategies. The internal series decides which one exists.

Source trail: Phase-1 Break-even Plan · 30km Fresh-Eyes red-team · current Master State.

04 · Node-count conflict

Four scale claims. Not one fleet.

MN surfaces report tens of thousands of nodes or IPs. GoProxies advertises 80M+ IPs across mixed proxy products. Until the units and supply relationship are reconciled, none of these can be used as one fleet number.

verified public unresolved

Observed public claims

One surface speaks about active nodes. Another reports participating IPs. A health dashboard showed a higher count and a much wider country total. GoProxies then advertises an 80M+ commercial IP pool across residential, ISP, and datacenter products.

The first three may measure devices, IPs, sessions, ever-seen countries, or currently active countries. The GoProxies figure may include upstream inventory, reusable addresses, and several product-specific pools. It is not established as an MN node count.

The error is not choosing the wrong number. The error is combining them as if they share a denominator.

SurfaceObserved figurePossible basis
Mysterium mothershipApproximately 22k active nodes; 135+ countries.Possibly active node instances.
MystNodes landing31,547 IPs; 135 countries.Possibly participating IP addresses.
Network-health dashboardPrior read: 32,570; 182 countries.Possibly ever-seen or differently windowed activity.
GoProxies storefront80M+ ethically sourced IPs; 200+ locations.Commercial inventory across multiple proxy classes; source mix unknown. Not an MN node count.

The exact reconciliation needed

Unit counted, activity window, deduplication method, IP-versus-device relationship, country definition, SKU source, own-network versus upstream supply, and historical-versus-current scope.

Decision implication

Do not sell “182-country MN breadth” or an “80M-node network.” If the long-tail coverage is real, persistent, and attributable to controllable supply, it may matter more than raw fleet size for measurement products.

Source trail: Mysterium public homepage · MystNodes landing · World Network Health dashboard · GoProxies homepage, checked Jul 24, 2026 · Public-surface Sweep.

05 · GoProxies supply

GoProxies is not one pool of MN bandwidth.

The storefront advertises more than 80M IPs across several product classes. MN publicly shows tens of thousands. “Scale GoProxies” could mean network monetization, upstream resale, or both.

verified public supply gate open

Why the mismatch matters

GoProxies sells rotating residential, dedicated ISP, shared datacenter, and dedicated datacenter inventory. Mysterium’s network cannot be assumed to supply every SKU, every advertised IP, or every geography.

A publisher tag naming MN Intelligence supports an operational connection. It does not disclose who contracts, where inventory comes from, or how margin moves between entities.

ForkGood versionBad version
Mostly own-network supplyDistinct supply economics and a real integration advantage.Operator risk, quality, and geographic availability may constrain scale.
Mostly upstream resaleCan grow independently of node supply; simpler commercial margin business.Little structural moat; direct price competition with larger neighbors.
Mixed portfolioUse each source where it is strongest.Opaque transfer pricing can hide weak contribution and risk concentration.

The SKU ledger required

SKU × source × contracting entity × transfer price × customer cohort × direct cost × contribution margin × consent/control evidence × incident rate.

Decision implication

“Grow GoProxies” is not a strategy until this table exists. The correct move may be network monetization, standalone resale, a split portfolio, or stopping a negative-margin SKU.

FWA / consented-mobile supply — killed as a supply strategy. Subscriber consent does not override carrier restrictions. Verizon's current mobile agreement restricts resale, and its residential terms restrict resale, server hosting, and commercial-network use. That does not prove every carrier has identical language; it proves carrier-by-carrier permission is a gate. No mobile-grade trust premium has been measured. What survives is a cheap classification test on FWA or mobile nodes already in the network — not a compliant-supply promise.

Source trail: GoProxies product and pricing pages · MN node surfaces · registry sweep · 30km Fresh-Eyes adjudication · Verizon mobile customer agreement · Verizon residential terms.

06 · Operator risk

Germany: two raids reported in one week.

12 Sep 2024: P2P Newswire reported at least two residential MystNode operators had their homes raided after malicious content was routed through their nodes.

reported cases official 2020 case

Cases prove occurrence. They do not establish an incident rate.

German record

DateHard recordSource
12 Sep 2024≥2 residential operators reported police raids within one week after malicious content traversed their nodes. Specific claims tying the raids to a B2B setting were not independently verified.P2P Newswire ↗
15 Apr 2020A German runner received a copyright claim over content uploaded through the node. Mysterium says connection data showed other household/network users and the case closed.Mysterium ↗

Current Mysterium documents

RecordWhat it saysSource
Public trafficHigher abuse risk and higher earning potential. Germany is one of seven countries where enabling it is not recommended.MystNodes help ↗
Terms §6No guarantee against illegal or criminal traffic. Help with legal inquiries is discretionary.Exit-node terms ↗
Terms §11 / §16Operator indemnifies NetSys, including attorneys’ fees. Panama law; exclusive Panama courts.Exit-node terms ↗
Reference classEFF: running an exit from home is risky; police may raid, seize computers, and suspect the operator.EFF ↗

Still unknown

Public incident rate · outcomes of the 2024 investigations · current B2B traffic segmentation · response times and support history · GoProxies overlap.

Decision

No ethical-supply claim or scale push until traffic controls, operator protection, and incident response are measured and counsel-reviewed.

Direct sources: 2024 German raid report · 2020 German claim · current safety guidance · current terms · EFF reference class.

07 · Infrastructure value

Network activity is real. Redirectable value is not yet measured.

Petabytes of traffic prove a live system. They do not prove premium proxy inventory, spare capacity, or a simple path from bandwidth to revenue.

activity verified monetizability unproven

The killed shortcut

We once divided estimated break-even revenue by current network throughput and concluded that selling roughly 5–8% at proxy prices could close the gap. That was a category error.

VPN video traffic is not inventory that can be “redirected” to proxy buyers. Sellable supply depends on geography, uptime, concurrency, IP class, fraud score, carrier terms, consent, and whether workloads can coexist.

PropertyPotential valueProof still needed
Long-tail geographyMeasurement, availability checks, and compliance tests in hard markets.Persistent active coverage after node-count reconciliation.
Permissionless settlementCrypto-native access and machine-paid usage.Buyer demand and a stablecoin-standard integration path.
On-chain provenanceAttestation where verifiable origin matters.Actual consent and control surface; buyer willingness to pay.
Existing communityCold-start advantage for any new supply-side product.Persistence, concentration, and acceptable operator economics.

What the network is not

It is not competitive on raw scale against fleets two or three orders of magnitude larger. Volume alone is not the moat.

Decision implication

Value the properties separately. Keep what creates a measurable advantage; do not preserve raw-volume ambition or dVPN identity merely because they are old.

Source trail: Infrastructure Assessment · Questions to Excavate · 30km Fresh-Eyes red-team.

08 · Market shape

The money is real. So is the competition.

VPN, proxies, and agent-access infrastructure are valuable markets. MN enters them beside category leaders with larger teams, deeper trust surfaces, and established sales motions.

multi-source public

Scale figures are time-sensitive and must be rechecked before external quoting.

The flattering half

Bright Data reports more than $300M in annualized revenue, more than 50% year-on-year growth, and 14 of 20 leading LLM labs as customers. Oxylabs reports more than $350M in annualized group revenue. Tesonet's broader portfolio reported more than €1B in 2024; that number is not attributable to VPN and proxies alone.

The hard half

Those same companies already sell the trust, compliance, integrations, and agent-specific products that a generic MN pitch would promise. Market proof is not right-to-win proof.

BattlefieldWhy it attractsWhy MN should not attack head-on
Generic residential proxyLarge, proven B2B demand.Mature incumbents, procurement moats, dedicated sales, price pressure.
Agent browser infrastructureReal pain and recent funding.Purpose-built vendors compete on browser sessions, developer experience, and stealth — not IP supply alone.
Consumer VPN growthExisting installed base and known revenue.Commodity category dominated by better-capitalized brands; defend only if the decline is fixable.
Narrow protocol-native accessPotential structural fit with MN rails and community.Demand is still hypothetical; no-KYC can worsen risk and procurement.

What survived the kill pass

Not a market promise. A search discipline: avoid scale wars, find a property incumbents cannot or will not offer, then demand buyer evidence before product work.

Decision implication

The comparison set proves there is money. Internal contribution data and external buyer discovery decide whether MN has a wedge or only proximity.

Source trail: Market Map · Outside-in X-ray · Alpha Hunt · Bright Data company reporting · Oxylabs financing report · Go Vilnius company profile · Tesonet portfolio reporting.

09 · No-KYC demand

No-KYC is not a moat.

It may be a reason a narrow buyer chooses MN. It may also be the reason a good buyer, a payment partner, or a procurement team refuses it.

discovery only

Killed as a promised trial torpedo. Preserved as a testable question.

Why it looked structural

Corporate proxy providers are built around contracts, identity, and audit. MN already has crypto settlement and permissionless supply. That makes a protocol-level purchase path plausible in a way it is not for a standard enterprise vendor.

Why that is not demand

Absence of incumbents can mean an unmet market. It can also mean the segment is small, abusive, unreliable, or impossible to serve profitably under buyer-screening and operator-protection requirements.

Must be trueHow to testKill signal
Legitimate buyers need itNamed cohort interviews around repeated blocked-access pain.Interest is ideological but willingness to pay is absent.
Identity-light can coexist with controlsDesign buyer screening, traffic limits, incident response, and source segmentation.The only demand requires unacceptable abuse tolerance.
Procurement friction is lower, not higherPaid pilot with a buyer who rejected conventional vendor onboarding.Legal and reliability concerns outweigh the convenience.
Contribution is positiveMeasure realized margin after supply, abuse, support, and payment costs.Revenue grows while risk-adjusted margin stays negative.

Current evidence

No named prospect list, no paid pilot, no buyer interviews, and no conversion signal. The fit argument is architectural, not commercial.

Decision implication

Discovery may continue. A growth promise may not. The first credible milestone is a lawful, screened, positive-contribution paid use case.

Source trail: Market Map · Alpha Hunt · 30km Fresh-Eyes red-team and final adjudication.

10 · Token revival

Tokens do not revive themselves.

Every defensible recovery we studied combined continued product work with a large external narrative wave. None began as small and illiquid as MYST is now.

precedent study base-rate estimate

The comparison problem

“Down 95%” sounds comparable across tokens. It is not. Helium, Render, Fetch, and Injective still had tens or hundreds of millions in market value, deeper liquidity, larger teams, and access to capital at their troughs.

MYST sits in a much smaller, thinner zone. The survey found almost no clean fundamentals-led comeback from that exact starting condition.

PrecedentRecovery mechanismWhy it is not a clean MYST analog
Fetch.aiAI narrative plus a three-token merger.Never reached MYST-level micro-cap illiquidity.
HeliumSolana migration plus a new mobile product and DePIN wave.Trough still roughly in the hundreds of millions.
RenderReal GPU marketplace plus migration and AI-compute wave.Far larger and directly aligned with a massive new demand wave.
InjectiveKept shipping, raised substantial capital, rode DeFi/alt-L1 recovery.Closest pattern, but still roughly forty-plus times larger at the bottom.

The honest base rate

Durable recovery from sub-$5M market value, thin daily volume, and a roughly 98% drawdown is estimated in the low single digits. No direct dataset for the exact composite screen was found.

Decision implication

MYST can amplify operational success when an external wave arrives. It cannot be the primary operating plan, the Phase-1 KPI, or the justification for weak economics.

Source trail: Token-Reanimation Precedents · public price histories · official migration, merger, and product announcements.

11 · Machine payments

Hermes is experience, not a market position.

MN has years of production micropayment knowledge. The wider machine-payment market is moving toward stablecoins and open protocols led by larger ecosystems.

market verified integration open

The tempting story

Agents need to pay for web resources. MN has operated machine clients paying nodes per use for years. It is tempting to turn Hermes into a general payments product.

The correction

Hermes is domain-specific plumbing and settles around MYST. The market is moving toward stablecoins and open protocols such as x402 and L402, backed by much larger networks. Rebuilding against them would burn the advantage.

AssetKeepDo not confuse it with
Production know-howFailure modes, settlement operations, node incentives, tiny-payment behavior.A general protocol buyers already demand.
Existing networkA resource that could become directly agent-payable.Proof that agents want MN egress.
Crypto-native cultureFaster integration and a natural test environment.A reason to force buyers into MYST denomination.

The practical question

Can MN put a standard stablecoin payment rail on top of a narrowly valuable access product without rebuilding the market’s payment layer?

Decision implication

Ride the standard. Use four-plus years of operational knowledge to integrate faster and safer. Never pitch Hermes itself as a hidden goldmine.

Source trail: Infrastructure Assessment · Coinbase x402 documentation · public L402 documentation · Wave Map.

12 · Market timing

A rising market is where you want to be.

Wave fit is not magic, but it is strategically important: expanding demand, falling costs, new standards, regulatory openings, and concentrated capital can multiply the upside available to a prepared company.

evidence-supported lens MN causality unproven

What is actually grounded

Markets do not move in mystical fixed cycles. Direction still matters. When technology, demand, standards, regulation, capital, and attention move together, building, financing, selling, and adoption can all get easier at once.

Empirical work supports timing and ecosystem readiness as real but conditional performance factors. Buyer demand, investment scale, entry mode, capabilities, and control of complementary assets decide who captures the value.

“Wave” is shorthand for that observable external shift—not an excuse for weak execution.

Mysterium chronology—not causal proof

WaveJobTiming
Ethereum railsMade tokenized, per-use network settlement technically buildable.Fast enabling substrate.
ICO capitalMade the 2017 raise possible in minutes.Tall, fast, then collapsed.
Privacy / sovereigntyCreated durable reason for the network to exist.Slow structural rise.
Resource sharing / DePINMade distributed consumer resources legible as an investable category.Crested years after MN’s launch momentum.

Mysterium is itself the counterexample to wave-as-guarantee. It caught Ethereum and ICO capital early, yet did not compound into an outsized business. That does not make the waves unimportant; it proves a tailwind is not self-executing. Demand, economics, capabilities, execution, and ownership of complementary assets still decide capture.

Evidence beyond Mysterium

EvidenceWhat it supportsWhat it does not prove
Steam, electricity, semiconductors, computersGeneral-purpose technologies create broad opportunity through improvement and complementary innovation.That any participant will win.
10 cases where one semiconductor-lithography technology replaced another, 1972–2009Replacement moved faster when the new technology’s supporting ecosystem was ready and the old technology had less room left to improve.That arriving early guarantees rapid adoption.
22-study entry-timing meta-analysis; 141,686 observationsTiming has a positive but modest average relationship with performance (ρ = 0.10), highly dependent on context and measurement.A universal first-mover law.
25,513 foreign-invested companies operating in ChinaCompanies that entered the market earlier gained more market share.That earlier was simply better: those companies also had lower survival rates.
Technology-licensing and complementary-asset researchInnovators often fail to capture returns when others control manufacturing, distribution, or other complements.That technical novelty captures the value it creates.
46 major product innovations, 1887–1986First-mover head starts existed.Durable protection: average time before competitive entry compressed from roughly 33 years to 3.4 years.

The corrected test

Score the external vector explicitly: falling cost, rising adoption, regulatory opening, a new standard, or concentrated capital and attention. Stronger, converging vectors raise a bet’s strategic priority.

Then ask whether MN has a specific advantage and the capabilities to capture them. A wave magnifies what is there; it cannot rescue absent buyer demand, weak unit economics, or missing complements.

Current status

The broader rule is evidence-supported: favorable market direction is a major advantage and should weigh heavily in strategy selection. The specific “one fast wave + one slow wave” formula remains a hypothesis, not a law.

Decision implication

Prefer Kairos bets where MN has both an ownable advantage and a rising market. Agent access × machine payments is commercially tight but early. Provenance × privacy is more coherent but build-heavy. Neither enters Phase 1 before the economic perimeter is real, but the wave map should shape what gets tested next.

Source trail: Wave Map · Mysterium whitepaper and ICO history · Bresnahan & Trajtenberg on general-purpose technologies · Adner & Kapoor on ecosystem timing · entry-timing meta-analysis · Murray, Ju & Gao on early entry · Teece on complementary assets.

13 · Decision gates

Four pulls decide almost everything.

The next valuable work is not another strategy deck. It is a reconciled baseline that makes one reversible, cash-quality test possible.

internal gates

Named owners and a decision line matter because data without adoption authority becomes another report.

The operating sequence

First define what the company is trying to make self-sustaining. Then reconcile the economics. Then choose the disposition of each line: defend, harvest, grow, partner, ring-fence as mission, or kill.

Only after that choice does a growth, retention, cost, or partnership experiment have an honest denominator.

PullMinimum contentsDecision unlocked
Group economicsEntity/product P&Ls, intercompany flows, current burn, treasury owner/mix/authority.Define the economic perimeter and real gap.
VPN series12–24 months of cohorts, collections, churn, cancellation reasons, and pricing events.Defend or harvest the dominant revenue line.
GoProxies contributionCustomer concentration, revenue quality, SKU source, direct cost, churn, and realized margin.Grow, partner, reshape, or stop each motion.
Risk & ownership mapSupply controls, consent evidence, traffic segmentation, incidents, accountable owner, and decision rights.What can be sold, claimed, and scaled safely.

What counts as proof

Retained recurring revenue or realized incremental contribution margin from a defined cohort. Meetings, clicks, pipeline, prettier pages, and theoretical capacity do not count.

What Kairos adds

The forcing function: dated owners, confidence-labeled claims, visible killed hypotheses, and a decision gate that converts knowledge into movement without pretending certainty.

Source trail: 30km Fresh-Eyes Audit · Questions to Excavate · Master State · Re-contract Clauses.