How to read this
This is the full initial research corpus behind Kairos: Asymmetric Unit. An orientation sweep, not a claim to completeness. Nothing here is polished for persuasion — it is the working state of what we actually know, believe, and have already been wrong about.
Three rules govern every line on this page:
- Every claim wears its confidence. A number without a source label is a rumor wearing a suit. Hover any badge for what it means.
- Everything we killed stays visible. The graveyard below is not humility theater — it is proof that the machine attacks its own conclusions before presenting them as recommendations.
- Exact internal figures are deliberately not printed here. This page sits on the open internet. Numbers reported verbally are treated as unverified until the first data pull and stated only in shapes: ratios and directions.
verified public registry insider · unverified n=1 hypothesis killed
This map now has a second layer. Wherever a compressed finding carries too much weight, open the linked evidence room for the correction trail, current facts, unknowns, and exact decision implication. Enter the evidence rooms →
The facts board
The current state of what we hold, after two red-team passes. Where a fact conflicts with itself across MN's own surfaces, the conflict is the finding.
| Fact | What we hold | Confidence |
|---|---|---|
| Revenue shape | ≈90% VPN subscriptions, declining · ≈10% GoProxies, growing ("2nd best month"). The decline rate we saw covers one month — the 12-month series is the single most important pull. Open the economics → | insider · unverified n=1 |
| Treasury & burn | Reported verbally through one channel and still unverified — including whether the treasury is fiat or crypto, who legally owns it, and who can authorize its use. Figures deliberately not printed here. Open the required pulls → | insider · unverified |
| The entity map | BlockDev AG (Zug, protocol) · UAB MN Intelligence (FY2025: €1.13M revenue, −€268k, 13 employees; runs VPN, schema-tagged on GoProxies) · UAB MN Technologijos · NetSys Inc. (Panama; MystNodes operator). Which entity legally contracts GoProxies — and the intercompany economics — still open. Open the entity map → | registry |
| MYST token | ~$0.09 · ~$2.9M cap · ~$30k/day volume · MEXC-led · no Binance; −98% from ATH. Roughly two orders of magnitude smaller than Grass by market cap. The networks' published scale figures use different counting bases and are not a clean node-for-node comparison. Open the precedent study → | verified public fleet comparison unresolved |
| The node fleet | Conflict: ~22k active (mothership) vs 31,547 IPs / 135 countries (MystNodes landing) vs 32,570 / 182 countries (dashboard) — plus GoProxies’ 80M+ IPs / 200+ locations. The GoProxies number is a commercial inventory claim across mixed proxy products, not an established MN node count. The counting bases and supply relationship do not reconcile. Open all four scale claims → | verified public unresolved |
| Team | ~26–28 visible on LinkedIn vs "~40" said internally; hiring frozen (empty Workable). | verified public insider |
| GoProxies | Reported internally as in-house, with a separate sales motion. Public pages verify pricing from $2.40/GB to $1.40/GB at volume, live self-serve checkout (card + crypto), and a Scraping API in private beta. But: 80M+ advertised IPs cannot be MN's ~22–31k nodes. The contracting entity, supply mix, and contribution economics remain unresolved. Open the supply fork → | insider verified public supply open |
| Node-runner risk | 12 Sep 2024 reporting: ≥2 German residential MystNode operators said police raided their homes in one week. Separate German copyright claim presented 15 Apr 2020; Mysterium says it closed. Current terms: assistance discretionary, operator indemnity, Panama forum. Open the cases and direct sources → | verified public |
| Content engines | Four surfaces: near-daily VPN news desk · GoProxies research arm (with press pickup) · thin MystNodes blog · dead legacy blog. The current mothership links product doors, but narrative, entity, metric, and trust coherence remain fragmented. The one consistent engine aims at the declining product. Open the full inventory → | verified public |
| The market | Bright Data reports >$300M annualized revenue, >50% year-on-year growth, and 14 of 20 leading LLM labs as customers. Oxylabs reports >$350M annualized group revenue. The broader Tesonet portfolio reported >€1B revenue in 2024; that figure spans more than VPN and proxies. The money is real. So is the competition. Open the market map → | verified public |
What we killed
Between July 3 and July 18, twelve claims died or were materially downgraded — killed by our own adversarial passes, not by events. Each corpse below was caught before it became a recommendation. This section shows how the page was tested; it does not make the surviving claims true by association.
False — our own early claim. Direct crawl found a near-daily news desk and three more engines. The real problem is fragmentation, which is a different lever entirely.
Subscriber consent does not override carrier restrictions, and no trust premium has been measured. It survives only as a cheap classification test on supply that already exists — not as a compliant-supply promise.
It's a demand hypothesis wearing a moat costume — with adverse-selection, abuse, and procurement risk attached. Dead as a promise; alive only as a discovery question.
Category error. Network activity is proven; monetizable proxy capacity is not. Most volume is low-value VPN traffic, not premium supply.
Built on prior-year accounting unreconciled to current revenue, with burn ownership unproven. Struck from the facts board.
No clean precedent exists at MYST's depth. Every recovery we studied (Injective, Fetch, Helium, Render) began tens of times larger and rode an external narrative wave. Honest base-rate estimate: low single digits.
Vendor-dense and freshly funded — Browserbase at $300M, Firecrawl, Anchor, plus incumbent agent SKUs. Arriving late with less capital is not a wedge.
A 500-plus-person neighbor reporting more than $350M in annualized group revenue. Right-to-win analysis returned: none.
Consent and control remain operating gates, not a demonstrated legal or commercial moat. Carrier terms, traffic controls, source evidence, and incident response must each hold; provenance language cannot substitute for them.
A commodity race against better-capitalized players in a declining category. Not our war.
The market is moving toward stablecoins and open x402/L402 rails led by larger ecosystems. The real asset is 4.5 years of micropayment know-how — reuse it without making Hermes the product.
One good month. No churn, margin, concentration, or supply-source data. Promising signal, not an engine — yet.
What survived
The insights that took two red-team passes and are still standing. These are the load-bearing walls.
- The money is up the stack. Raw gigabytes are a commodity; the 10–30× markup lives in managed, per-success access. GoProxies' own Scraping API beta points the same direction.
- The founding premise is the baggage. Positioned as a 2016 decentralized VPN while materially operating a 2026 portfolio across consumer VPN, proxy resale or aggregation, and protocol infrastructure. That diagnosis survived. The replacement positioning remains open until buyer demand, supply control, entity boundaries, and contribution economics are known.
- A rising market is where you want to be. Ethereum and the ICO market made MN buildable and fundable; privacy and DePIN matured more slowly. Wave fit is a major strategic advantage: it enlarges the prize and lowers the friction for a company ready to capture it. MN caught the fast waves and still did not compound, so a tailwind is not a guarantee. Treat it as a major selection criterion alongside demand, economics, capabilities, and control of complementary assets. Open the evidence and limits →
- Mysterium is a portfolio, not one business. Commercial VPN, GoProxies, node/protocol infrastructure, and the mission layer have different economics and need separate boundaries. Token holders and node runners are constituencies, not revenue lines. Break-even is meaningless until the commercial P&L and the deliberately-subsidized mission work are separated — that separation requires an explicit board-level decision. Open the perimeter problem →
- The melting base outruns growth — if the decline is real. Arithmetic: even punishing proxy growth loses a year-one race against the VPN slide we saw. But that slide is one month of data. Which is why the 12-month series is pull #1, before any structural conclusion. Open the economics →
- Node economics are structurally contradictory. Residential operators carry the highest legal exposure, while lower-risk datacenter supply earns little. Any future that leans on the node network must solve protection, traffic control, and compensation honestly. Open the risk structure →
- Fragmentation may be a firebreak, not just a failure. The entity and brand separation that looks like marketing chaos may be deliberate risk isolation. Resolve its purpose before consolidating anything.
- Agent traffic may fit the architecture. Low-volume, human-paced traffic could match distributed supply better than bulk scraping. It does not cure carrier terms, buyer screening, liability, or operator protection. The fit remains a cheap test, not a conclusion.
- We sell urgency, not analysis. A long runway is comfortable, and comfort has no forcing function. The unit's real product is dated decisions: every phase ends with a written continue/stop/redirect call by the named decision owner.
- An abandoned surface is negative, not zero. Commit to a cadence or don't start — proven by MN's own portfolio of half-alive properties. We apply the same rule to ourselves.
The open questions
What we genuinely don't know yet — ranked by how much hangs on the answer. "We don't know yet" is not a gap in this proposal; it is the honest map of where the work starts.
| Question | Why it's pivotal | Status |
|---|---|---|
| Is the VPN decline fixable or secular? | The fork the whole Phase-1 plan hangs on: stabilize the base vs controlled contraction into the growth line. Open the economics → | open · pivotal |
| Where does the commercial business end and the mission begin? | Break-even can't be defined — let alone reached — until the deliberately-subsidized mission work is ring-fenced from the P&L that must carry itself. Open the perimeter problem → | board-level |
| What is GoProxies actually made of? | Supply source, consent chain, transfer price, and margin per SKU. If it mostly resells upstream supply, "scale GoProxies" is a standalone margin business, not network monetization — a different (not necessarily worse) story. Open the supply fork → | open · gate |
| Treasury: owner, mix, authority? | Every capital-allocation option — including buying revenue instead of growing it — is imaginary until ownership, liquidity, and decision rights are documented. | unverified |
| Which node count is real? | The 135-vs-182-country conflict decides whether geographic breadth is a genuine advantage or a stat artifact. Open the count conflict → | unresolved |
| Crypto-native, no-KYC demand — real buyers, at what quality? | A space conventional enterprise vendors may avoid. But no-KYC also invites the exact abuse that destabilizes supply — discovery must answer both sides. Open the hypothesis → | discovery |
| Is ideology the revenue ceiling? | The origin story may be capping monetization. Proton is the structural precedent that mission and margin can coexist — the question is what it costs here. | load-bearing |
The four must-pulls, day one: real burn with breakdown and decision rights · the 12-month VPN cohort/churn series · GoProxies contribution economics by SKU and customer · the entity/intercompany map. Everything above unblocks from these four.
And the fifth pull isn't a document. A named money-owner with a 48-hour answer line is the floor, not the whole ask — most of what Mysterium knows is written down nowhere. It lives in the team, and it surfaces through listening access: Slack presence and informal coffee conversations, opt-in, zero meetings added.
Open the complete decision gate →Where we hunt
Three concentric rings. We don't know yet which holds the asymmetry — we know precisely where we're looking, and every find comes back as a proposal with a decision gate. A named decision owner makes the call, every time.
The current company
MN's team, products, and processes: the economic perimeter, where margin leaks, and the one or two places a small move creates the biggest change. The four must-pulls live here.
The team, aimed outward
Opportunities outside the current products that MN's existing team, infrastructure, and know-how could be pointed at — in part, at first. New lines on existing rails.
Capital & network
Asymmetric opportunities that never enter the MN team — deployed through its capital and, where useful, its network. Each one arrives as a standalone proposal with its own gate; nothing is pre-authorized.
The optimism case
"Problems are inevitable. Problems are soluble." — David Deutsch, The Beginning of Infinity
Everything above is the sober half. Here is the other half, and it is not decoration: the pessimistic reading of this initial sweep is incomplete. Deutsch's argument — the one this unit operates on — is that problems yield to knowledge-creation, and knowledge-creation is exactly what a small, fast, honest unit is for. The graveyard above is not a list of losses. It is the engine running.
What the ground actually holds:
- Large markets have been built from this city. Bright Data reports more than $300M in annualized revenue; Oxylabs reports more than $350M; Tesonet's broader portfolio reported more than €1B in 2024. That proves demand and local capability, not MN's right to win.
- A residential network across 135+ countries may be expensive to rebuild. Its value depends on controllable coverage, consent evidence, traffic controls, supply quality, and node-count reconciliation. Those are gates, not adjectives.
- Nine years of protocol know-how, including 4.5 years of production micropayment rails. Mysterium can reuse that operating knowledge while adopting current standards; it does not need to make Hermes itself the product.
- Some external conditions now move in MN's direction. Machine-paid web access, privacy pressure, and renewed interest in decentralized infrastructure are tailwinds worth testing against. They are not proof of demand, timing, or capture.
- Time is the treasury's real gift. Runway means the next move can be chosen deliberately instead of desperately — if it's paired with the forcing function it dissolved. That pairing is literally what this unit is.
- An honest map is a weapon. The correction trail and confidence labels make weak ideas cheaper to kill. That discipline, compounded weekly, is the asymmetry that may find the others.
"We don't know yet" is the position of someone standing at a beginning, not at an end. Fixed targets today would be fiction dressed as rigor. What we commit to instead is the machinery on this page: confidence-labeled claims, killable hypotheses, dated decisions with named owners, and a bounded search those make safe to fund.
The library
The initial corpus, July 3–23. Each entry now opens into the most relevant public-safe evidence room. Raw working documents stay internal; their usable claims, corrections, and limits do not.
Foundations
Research DossierJul 3
The opening deep-scan: a real, technically alive 9-year project — ~€14.4M ICO in 45 minutes (2017), daily commits, 110 repos — with a micro-cap token and much larger adjacent networks. Market-cap scale is comparable; published fleet counts are not.
Open the market context →Research Program (10×)Jul 5
The self-critique that started the discipline: six falsifiable hypotheses with explicit kill criteria, and the four-phase program (X-ray → market map → alpha hunt → synthesis) the rest of the corpus executed.
Open the evidence directory →Frameworks: Dunford + HROJul 13
Two lenses — Dunford (positioning) and HRO (blind spots) — one diagnosis: positioned as its 2016 self while materially its 2026 self, inside an organization whose long runway dissolved the forcing function. Self-aware caveat kept: part of the mapping is confirmation scaffolding, and says so.
Open the operating instrument →Outside-in
Outside-in X-rayJul 5
The public surface, cold: a well-rated consumer VPN (4.7★, 5.1K reviews) in a commodity market, zero visible B2B/agent engineering in the top 20 repos, and a token at −98% from ATH. Two findings later corrected by the sweep — corrections logged.
Open the correction trail →Market MapJul 5–6
Eight incumbents, two newcomers, demand-side audit. Killed our own "30 desperate unserved buyers" framing; found the one structurally uncontested space (crypto-native, no-KYC) — later itself downgraded to a discovery hypothesis. Bright Data's court wins and $300M ARR anchor the ceiling.
Open the market room →Public-surface SweepJul 18
The corrections ledger: "blog dead" was false (fragmentation is the truth), GoProxies self-serve checkout and Scraping API beta found live, the entity map resolved from registries, and the node-stat conflict flagged as load-bearing.
Open the content inventory →Node-Economics & Operator RiskJul 17
12 Sep 2024: ≥2 German residential MystNode operators reported police raids within one week. Separate copyright claim presented 15 Apr 2020; Mysterium says it closed. Current terms make assistance discretionary, require operator indemnity, and select Panama courts.
Open the cases and direct sources →Token-Reanimation PrecedentsJul 6
Every studied recovery (Injective, Fetch, Helium, Render) began tens of times larger and rode an external wave plus shipped product. Honest base-rate estimate from MYST's zone: low single digits. Token revival stays a second-order effect unless the underlying operation earns it.
Open the precedent room →Wave MapJul 17
The timing audit: Ethereum and ICO capital made MN buildable and fundable; privacy, machine-paid web access, and decentralized infrastructure now create conditional tailwinds. The corrected rule is simple: a rising market helps only when demand, economics, capabilities, and complementary assets let MN capture it.
Open the timing room →Infra AssessmentJul 17
Infrastructure is instrumental, not sacred: four genuine advantages (breadth, permissionless rail, on-chain provenance, community) — and raw bandwidth volume explicitly not among them. Its boldest claim ("5–8% to break-even") was later killed by the audit; the kill is logged in the graveyard.
Open the asset room →Synthesis & red-team
Alpha HuntJul 6
Nineteen candidate levers generated, run through a feasibility filter (small team, ≤90 days, no head-on incumbent fights), six killed with named reasons, five survivors — and the week-one fork question that decides between branches.
Open the kill logic →Phase-1 Break-even PlanJul 17
The parametric model: even at punishing proxy growth rates, the year-one race is lost to the VPN slide we saw — if that slide is real (n=1). Produces the three-lever sequence and the fixable-vs-secular fork the open-questions board now carries.
Open the economics room →Questions to ExcavateJul 17
The master question list, split "ask insiders" vs "investigate ourselves," ranked by leverage on the break-even path. The four must-pulls on this page are its top of stack.
Open the decision gates →30km Fresh-Eyes Audit + adjudicationJul 18
The alien-eyes pass, a second adversarial red-team, and a final adjudication. Found the missing balance sheet, the forcing-function risk of a long runway, the portfolio reframe, and the GoProxies supply gate — and struck five of our own conclusions from the record.
Open the portfolio reframe →Master Statelive
The living board the whole corpus rolls up into: facts with dates and confidence, an append-only insight ledger where killed ideas stay struck-through and visible, and the hypothesis board. Updated after every working session.
Open the reconciled layer →