How Arcanus works

Arcanus is a decentralized dePIN privacy protocol settled on Arc Mainnet. dePIN means decentralized physical infrastructure: real machines in real cities, run by independent operators, selling bandwidth into a live marketplace. The website is the control plane. You sign in, pay for capacity, and take a key that never belonged to us. The data plane is the VPN, the voice room, the letter, or the live thread.

This is not a subscription. You buy gigabytes for the VPN and minutes for the voice. Unused months do not exist here because we do not sell months. Mail and Messenger are separate products on the same encrypted messaging rail — a letter desk and a live chat — each with its own one-time gate, never a per-send fee. Infer is the paid desk for answers: $ARCANUS or native USDC per token, a signed ceiling to the treasury, no API key. Shield is a private USDC pool: in from one wallet, out to another with a note.

A typical VPN is one company, one farm, one policy. Arcanus is a protocol sitting on a marketplace of cities. If Zurich is full, you pick another door. The brand you see is Arcanus. The network underneath is many machines, not one warehouse. The desktop browser is the quiet window those products open in — privacy defaults already on, browsing kept on the machine.

In Latin, arcanus means hidden, secret, mysterious, private — of the inner things. It comes from arca: a chest, a coffer, a box where valuables are kept. The protocol is named for the act of keeping, not for a vendor.

If it is not yours to read, it remains arcanus.

1. 01

   Device

   Session keys for the VPN are created here. Voice frame keys live here. Messaging installation keys live here. The private material never leaves.

2. 02

   Control plane

   This site: sign-in, city list, minute balance, handshake, mail desk, messenger. Protocol agents score cities, watch the receipt, and complete setup. They sit on this plane only.

3. 03

   Data plane

   WireGuard / V2Ray to a live city, an audio-only room, ciphertext in mail, an encrypted messenger thread, or tokens from an Infer node you paid. Packets and prompts do not travel through the website as the product — the site is the shop.

4. 04

   Settlement

   $ARCANUS is the protocol token on Arc — primary checkout, hold checks, and wallet balances. Native USDC on Arc is gas and the secondary checkout. The treasury is a 0x you can see.

5. 05

   Capacity

   Independent city operators. You never see their marketplace name. You see a city.

Those layers are the whole architecture. A receipt on Arc is not a wiretap. A city that forwards packets cannot reconstruct your messaging inbox. A messaging node that delivers envelopes cannot hear a voice room. Each product is sealed at the place it actually runs.

Arcanus VPN is the website plus a key on your device. There is no kernel driver in the browser. You pick a live city, spend $ARCANUS for gigabytes, and import WireGuard or V2Ray into the official apps. From that moment the path is your device talking straight to that city. The site is the control plane. It is not the tunnel.

A typical VPN is one company, one warehouse, one policy. This is a dePIN: independent operators run real machines in real cities and sell capacity by the gigabyte. The dVPN is provided by Sentinel. The directory you see is a live list of those cities — scored for reachability before they appear, retried if one goes quiet. You are buying a session on a physical node, not a sticker on someone else’s cloud account.

Get started

1. 01

   Open the dashboard

   Any browser. Sign in. The VPN tab is the city list — latency, protocol, and load shown up front.

2. 02

   Pick a live city

   Independent operators. If Zurich is full, pick another door. You never see a marketplace name. You see a city.

3. 03

   Spend $ARCANUS for GB

   Public list price is $0.09 per gigabyte. Packs are a shortcut, not a trap. Native USDC still works for gas and as the secondary checkout.

4. 04

   Import the key

   Download the setup file. Official WireGuard or V2Ray apps. Encryption starts on the device and never leaves it.

The session

1. 01

   You open the dashboard. Any browser. That is the shop and the handshake — not the tunnel itself.

2. 02

   You connect a wallet. That 0x is who paid. It is not printed on the packets that leave the city.

3. 03

   You pick a city and how many gigabytes. The screen quotes location plus the Arcanus fee before you confirm.

4. 04

   You settle on Arc Mainnet. $ARCANUS is the protocol token. Native USDC is gas and the secondary checkout. The chain is a receipt, not a packet path.

5. 05

   The control plane opens a session with that city and runs a handshake against the node’s remote address. You receive a setup file.

6. 06

   You import it. From that moment the data path is your device talking straight to the city. Arcanus is no longer in the packets.

Your wallet pays. The city forwards.

Phone companies and monthly VPNs issue you a rented identity, store it in a database, and can recycle it. Arcanus does not issue a tunnel account. The 0x you already hold is how settlement knows you paid. The session key is created on the device. Losing the laptop does not give us a copy, because we never stored one.

How the VPN actually moves

Arcanus is not a VPN company with a website painted on. It is also not “browsing on a blockchain.” A session uses three planes that must stay separate, or you get either a surveillance product or an unusable toy.

Settlement is on Arc Mainnet: you spend $ARCANUS (native USDC still works), gigabytes sit on that checkout, and a city is reserved. That ledger is a receipt. It is not the browsing.

Signaling is the control plane noticing that a wallet paid for a city and completing a handshake with that node. For WireGuard the handshake exchanges X25519 public keys and returns the server public key plus the UDP endpoint. For V2Ray it registers a UUID and returns transport metadata — host, port, and the obfuscation path. You receive a file. The website does not stay in the data path after that.

The path is encrypted traffic from your device to the city you paid. Browsers cannot attach a kernel tunnel — that is why you import an official client. The local network sees a session to that city. It does not see the sites inside.

Why a mesh of cities, not one company’s farm

A conventional VPN terminates every customer in one vendor’s data center. That is simple to operate and simple to subpoena, throttle, or take offline. Arcanus VPN is a dePIN: independent operators run the machines. Those cities appear in a live directory so they can be discovered, paid for capacity, and replaced if one drops. Community operated infrastructure instead of a single HQ box.

There is no fixed public tunnel URL baked into the website. A static endpoint to one region would be a VPN company with extra steps. You pick a city. If that city fills or goes quiet, you pick another. Taking down one marketing domain is not the same as seizing every city, and seizing one city is not the same as seizing your key. The key is on your device.

What happens the moment you pay

1. 01

   The quote is locked: city, gigabytes, location price, protocol fee. Nothing is reserved until you confirm.

2. 02

   You send $ARCANUS (or native USDC) to the treasury on Arc. Checkout charges however many tokens that USD is worth at the live pool price.

3. 03

   The control plane waits for the receipt, then opens a session with that city only.

4. 04

   A handshake runs against the node’s remote address. Protocol agents sit on this plane. They never decrypt the tunnel.

5. 05

   You download a setup file or scan a code. Session secrets were created on the device.

6. 06

   You import WireGuard or V2Ray. The website is done. Packets go device ↔ city.

WireGuard or V2Ray

WireGuard is the ordinary path: a kernel-level encrypted tunnel using Noise_IK, Curve25519, ChaCha20-Poly1305, and BLAKE2s. It changes the system IP. It is fast. It needs a client that can install a tunnel interface.

V2Ray / VLESS is the hostile-network path. It rides inside a userspace proxy with transport obfuscation so a noisy firewall sees something that looks like ordinary web traffic instead of a VPN handshake. Use it when a network is stricter. You still import a standard client. Arcanus does not ship a kernel driver in the browser.

Encryption, and what is not on-chain

The path is encrypted in transit. WireGuard wraps the session in Noise and AEAD. V2Ray wraps it in the transport you picked. Arcanus does not put browsing on Arc Mainnet. Explorers will never be a history.

What is visible, if someone already knows the wallet, is the boring part of a bill: that gigabytes were purchased, that a city was requested. That is a receipt. It is not “which sites.” We do not keep a carrier-style browsing graph. The city operator sees encrypted packets from that session. An exit node can observe traffic leaving that city the same way any VPN exit can — pick cities you are willing to leave from.

Gigabytes, and $ARCANUS

$ARCANUS is how you buy capacity. That is the token’s job. You pick a city and a pack, pay on Arc, and the session is yours until the gigabytes are used. Native USDC is still accepted so someone can get a path without hunting a pool first. Checkout amounts still track USD. A pack costs the same in dollar terms; the $ARCANUS button charges however many tokens that USD is worth at the live market price.

• 1 GB

  $0.09

  A focused session or a single download

• 20 GB

  $1.80

  Maps, chat, and video across days of use

• 100 GB

  $9.00

  Always-on privacy without a yearly plan

Unused months do not exist here because we do not sell months. When the path is off, the meter is off.

VPN questions

Arcanus Voice is the website. There is nothing to sideload and nothing for an app store to gate. If a browser loads, you can take a call. Your 0x is the number. Spend $ARCANUS for minutes. Dial another wallet. Encrypted audio in the browser. Camera stays off.

Get started

1. 01

   Open any browser

   No install. arcanus.network works on café Wi-Fi, airport Wi-Fi, home Wi-Fi — anywhere you can load a site.

2. 02

   Your wallet is the number

   There is no SIM and no username to mint. The 0x you connect is how people reach you. Copy it, or share your call link.

3. 03

   Spend $ARCANUS for minutes

   That’s the utility. Packs are typically 5 / 15 / 30 minutes at $0.05/min. Native USDC still works. Minutes sit on that wallet until you talk.

4. 04

   Dial 0x. Talk privately.

   Both of you keep the tab open. Paste their wallet, reserve minutes, ring. Encrypted P2P audio. Camera stays off.

The call

1. 01

   You open the site. Any browser. Any Wi-Fi. That’s your phone.

2. 02

   You connect. Sign in and you have a number — your 0x.

3. 03

   You spend $ARCANUS for minutes. That’s the utility. Native USDC still works. Minutes stay on your wallet.

4. 04

   You send a link or an address. https://arcanus.network/dashboard?tab=voice&dial=0x…

5. 05

   They open Voice and you ring. Their tab plays a ringtone. While you wait, you hear ringback. They tap Accept. Encrypted voice.

6. 06

   You hang up. Talk time bills in whole minutes. Leftover reservation returns to you.

Your wallet is the phone number

Phone companies issue you a rented identity, store it in a database, and can port it, recycle it, or SIM-swap it. Arcanus never issues a number. The 0x you already hold is the line. Connect, and you can be reached. Nothing to mint, nothing to squat, no second name for the timeline.

That identity stays on the wallet across devices. New laptop, café machine, friend’s spare handset — open Voice, connect, same 0x. Minutes you already bought are still sitting there. The plastic SIM never entered the story.

There is no public directory of who you called. You share a 0x the way you already share a receive address. Private by default means we did not build a phone book for strangers.

How voice actually moves

Arcanus is not a carrier with a website painted on. It is also not “voice on a blockchain.” A call uses three planes that must stay separate, or you get either a surveillance product or an unusable toy.

Settlement is on Arc Mainnet: you spend $ARCANUS (native USDC still works), minutes sit on the paying wallet, a hold is taken when you ring, and whole minutes are billed when you hang up. That ledger is a receipt. It is not the conversation.

Signaling is Arcanus noticing that one wallet is ringing another. Your dashboard asks the site, on a short interval, whether anyone is calling your 0x. There is no phone company paging a radio in a locked pocket. If their Voice tab is not open, they will not hear the ring. That is an honest constraint, not a missing setting.

Media is real-time audio in the browser, built on dTelecom. Your microphone becomes a live audio track. Camera stays off on purpose. The two browsers connect through a media node that forwards packets; they do not dump speech onto a chain and they do not send uncompressed audio through Arcanus application servers as the listening path.

Why a mesh of nodes, not one company’s switch

A conventional call product terminates every conversation in one vendor’s data center. That is simple to operate and simple to subpoena, throttle, or take offline. Arcanus voice is a dePIN: independent operators run media nodes. Those nodes can be discovered, paid for bandwidth, and replaced if one drops. Community-operated infrastructure instead of a single HQ box.

There is no fixed public media URL baked into the website. A static socket to one region would be a phone company with extra steps. When you start or accept a call, the control plane looks up a suitable node — geographic routing so you land near a node on your continent, not a default machine an ocean away. Typical in-region latency is well under 100ms. Across continents the path is still a live call, not a voicemail product.

Nodes are selective forwarders, not conference recorders. For a 1:1 call that means: take the encrypted audio you published, send it to the other wallet’s browser, and do the reverse. The node does not mix you into a webinar, does not transcode you into a livestream, and does not keep a copy for “quality.” If a node disappears, you hang up cleanly and leftover reserved minutes return. You try again.

What happens the moment you hit Ring

1. 01

   Arcanus checks that you have enough prepaid minutes and that the target is a wallet, not yourself.

2. 02

   Those minutes go on hold. They are not spent yet. A miss or a decline puts them back.

3. 03

   The server opens a private room for the two 0x addresses and mints a short-lived access token bound to your wallet, that room, and permission to publish and subscribe to audio.

4. 04

   The server asks the node network which media endpoint is closest to you, then returns only what the browser needs: the token and a connection for that node.

5. 05

   Your tab connects, disables the camera, and publishes the microphone. You hear ringback while their inbox shows the incoming call.

6. 06

   When they tap Accept, they get their own token to the same room on a node chosen for their network path. Two people, two short-lived grants, one room.

7. 07

   Both browsers send and receive audio. UDP first. If a hotel NAT or a hostile firewall blocks UDP, the stack falls back so the call can still complete. Adaptive sending keeps the stream matched to the path.

8. 08

   Hang up, drop, or hit the reserved time: the room tears down, Arcanus bills whole minutes actually talked, and unused hold returns to the caller. The person who picked up is not charged and is not paid.

What the browser is allowed to do

The site asks for the microphone. That is the only media permission. Camera is forced off for the call — not a toggle we hope you find. If the browser blocks autoplay when the other person starts speaking, you get a “tap to hear audio” control; that is a browser rule, not Arcanus storing the call.

Mute and speaker controls act on your local tracks and on the remote audio element. They do not rewrite history on chain. If the path blips, the client tries to come back. If the other wallet disconnects, the call ends. We would rather hang up than pretend a dead path is still a conversation.

Encryption, and what is not on-chain

The conversation is encrypted in transit. Live voice wraps media so the path between your browser and the node, and onward to the other browser, is not sent as raw samples on the open internet. On top of that, encoded-frame encryption — insertable streams — encrypts each audio frame on the sender’s device before packetization. The media server can forward ciphertext. It cannot hear you. Arcanus does not put the waveform on Arc Mainnet. Explorers will never be a transcript.

What is visible, if someone already knows the wallets, is the boring part of a phone bill: that minutes were purchased, that a call was reserved, that a hold was released. That is a receipt. It is not “what was said.” We do not keep a carrier-style call graph for advertisers. There is no SMS identity and no contact-list upload to “find friends.”

End-to-end in the strong sense — keys that even the forwarding node cannot use — is how a private 1:1 product should work. Transport encryption is on from the first packet. Frame encryption means those packets are not a recording of the call. Arcanus’s application layer never needs the audio to bill you: billing is minutes, not a recording. If a node cannot produce speech, it cannot sell speech. That is the incentive we want.

Minutes, holds, and $ARCANUS

$ARCANUS is how you buy talk time. That is the token’s job. You pick a pack, pay on Arc, and the minutes sit on the paying wallet. Native USDC still works at checkout. After that, nothing is ringing yet. You still have to dial.

When you ring, Arcanus holds the minutes for that attempt. A hold is not a spend. If they decline, miss, or never had the tab open, the hold returns. If they pick up, talk time bills in whole minutes. Leftover reservation — you reserved ten, you talked for three — returns to you. When the pack hits zero, you stop ringing until you buy again. That is a wall you can see, not an overage plot twist.

The person you call does not get a payout and does not get a bill. Incoming never debits the receiver. If your friend has a huge pack and you have zero, you still cannot place the call. Buy. That asymmetry is how a phone works, and how we avoid a surprise invoice on pickup.

Minutes do not transfer to another 0x as a gift feature. They buy, or you place the call. The object stays simple: pack on a wallet, spend by ringing.

Reachability

A mobile carrier can wake a radio in a pocket. Arcanus cannot, because we are not a carrier. Both people keep Voice open — or come back within about forty-five seconds of the ring — to accept. Missed and declined rings return the reservation. Try again when both wallets are on the site.

Keep the dashboard tab alive if you want to be called. Share your 0x or your call link. They open a site, not a store listing. That is the whole introduction.

Voice questions

Arcanus Mail is correspondence, not a chat bubble. You write a letter — a subject, a body, optional files — to a wallet or to a name like mina@arcanus.network. Ciphertext the operator cannot read. Mail is the website. If a browser loads, the desk is there. Incoming letters are always readable. Hold $ARCANUS or pay once to send or reply. Nothing is spent per letter.

Get started

1. 01

   Open the letter desk

   Any browser. The inbox, the compose pane, the alias — that chrome is the product. It is not hidden behind a blank wall.

2. 02

   Your wallet is the address

   The 0x you connect is the inbox. Claim name@arcanus.network as a courtesy so people can write a name instead of a hex string.

3. 03

   Hold or pay once

   That’s the utility if you write. Incoming letters are always readable. Hold or pay once to send or reply — not to open the desk.

4. 04

   Write a letter

   Subject, body, attachments. Encrypted on the device. Delivery nodes see envelopes. They do not see plaintext.

The letter

1. 01

   You open Mail. The desk is visible. Incoming letters are always readable. Send or reply only if this wallet meets the hold or the one-time fee.

2. 02

   You connect. Sign in and you have an inbox — your 0x. An alias is optional.

3. 03

   You hold $ARCANUS or pay once. That’s the gate. There is no per-letter gas.

4. 04

   You address a 0x or a name@arcanus.network. The name resolves to a wallet. We store the mapping. We cannot open the letter.

5. 05

   You write. Subject, body, files. The payload is sealed on this device before it leaves.

6. 06

   They open Mail on their wallet. The letter lands in their desk, never in Messenger, never as a chat bubble.

Your wallet is the mailbox

Ordinary email issues you a rented identity on a company server. They can lock it, scan it, or hand it over. Arcanus never issues a mailbox we can read. The 0x you already hold is the destination. An alias is a directory courtesy, not a second account sitting in our database as plaintext mail.

That identity stays on the wallet across devices. New laptop — open Mail, connect, same inbox. Installations are created on the device after sign-in. Losing the device does not give us a copy of those keys, because we never stored them.

How mail actually moves

Arcanus is not a webmail company with a lock icon. It is also not “email on a blockchain.” A letter uses three planes that must stay separate.

Settlement is on Arc: a hold check against $ARCANUS, or a one-time treasury transfer. That ledger is a receipt that this wallet may use the desk. It is not the correspondence.

Signaling is delivery: an encrypted envelope addressed to an inbox. Mail is built on XMTP, using Messaging Layer Security (MLS, RFC 9420): key packages, welcome messages, epochs, and AEAD so that every letter is authenticated and encrypted to the current membership. Forward secrecy means a key stolen later does not open yesterday’s letters. Post-compromise security means a rotation after a leak restores the seal.

The letter itself is a structured payload — subject, body, optional attachments — not a chat bubble. Letters never show as messenger threads. Chats never show in Mail. Same encrypted rail. Two products. Two desks.

Why not one company’s inbox

A conventional private-email product terminates every letter in one vendor’s database. That is simple to search and simple to subpoena. Arcanus Mail stores ciphertext the operator cannot read. Delivery nodes see envelopes and routing topics. They do not sit inside the AEAD. Taking down one website is not the same as opening the chest. The private material never left the device.

Encryption, and what is not on-chain

Cryptographically, each device that opens Mail registers an installation: its own key pair, signed by the wallet. The network’s job is authentication and delivery. It hands around ciphertext topics. It does not sit inside the seal. Arcanus does not put letter plaintext on Arc Mainnet. Explorers will never be an inbox.

What is visible, if someone already knows the wallets, is that two addresses exchanged encrypted mail. That is a receipt. It is not the subject. It is not the body. It is not the attachment. Aliases are a mapping we store so a person can write a name. We cannot open the letter that used that name.

Mail questions

Arcanus Messenger is a conversation — not a letter, not a call. Paste a 0x. Talk. Encryption is end to end. There is no per-message gas. The inbox is the website. If a browser loads, the threads are there. Incoming chat is always readable. Hold $ARCANUS or pay once to send or reply. Nothing is spent per bubble.

Get started

1. 01

   Open the inbox

   Any browser. Thread list on the left, conversation on the right. The chrome is the product.

2. 02

   Your wallet is the handle

   No username to mint. The 0x you connect is how people start a thread with you.

3. 03

   Hold or pay once

   That’s the utility if you write. Incoming threads are always readable. Hold or pay once to send or reply — not to open the inbox.

4. 04

   Paste a 0x. Talk.

   A 1:1 thread is a two-member group. Encrypted on the device. Delivery nodes see ciphertext topics, not the words.

The thread

1. 01

   You open Messenger. The inbox is visible. Incoming threads are always readable. Send or reply only if this wallet meets the hold or the one-time fee.

2. 02

   You connect. Sign in and you have a handle — your 0x.

3. 03

   You hold $ARCANUS or pay once. That’s the gate. There is no per-message fee.

4. 04

   You paste their wallet. A 1:1 thread opens.

5. 05

   You type. The payload is sealed on this device before it leaves.

6. 06

   They open Messenger. The thread is live. It never appears as a letter on the Mail desk.

Your wallet is the handle

Chat apps issue you a username, store a contact graph, and can lock the account. Arcanus never issues a handle we can seize. The 0x you already hold is the person on the other side of the thread. There is no public directory of who you messaged. You share a 0x the way you already share a receive address.

How messenger actually moves

Messenger is built on the same XMTP rail as Mail — same installations, same ratcheting, same local conversation database, same MLS. The difference is the content type: a chat bubble, not a structured letter. A 1:1 thread is a two-member group. Adding a device is adding an installation to the inbox, then to the groups that inbox belongs to — not copying a password into a new phone. Up to a small number of installations can share one inbox; the recovery identity can revoke a lost device.

Settlement is only the gate. Signaling is delivery of ciphertext topics. The words never ride Arc as plaintext. There is no on-chain fee per bubble. The network authenticates and delivers. It does not read.

Encryption, and what is not on-chain

Forward secrecy means a key stolen later does not open yesterday’s thread. Post-compromise security means a rotation after a leak restores the seal. MLS authentication rejects a forged installation. Revoke a lost device from the recovery identity.

What is visible, if someone already knows the wallets, is that two addresses exchanged encrypted chat. That is a receipt. It is not the message. Explorers will never be a transcript.

Messenger questions

Arcanus Browser is the desktop client for people who use this network. It opens at arcanus.network — VPN, Voice, Mail, Messenger, Infer, and Shield — and it keeps browsing on the machine. Strict tracking protection is already on. You do not have to hunt through settings to turn the product into itself.

A new profile already refuses telemetry, resists fingerprinting, partitions cookies, strips known trackers from links, and upgrades plain connections. Sponsored shortcuts, stories, and on-device assistants stay off. History lives in an Arcanus folder. Other browsers on the computer are not read.

Get started

1. 01

   Download for Windows

   Windows 64-bit, version 156.0.1. The installer is the usual path. The zip is a portable copy.

2. 02

   Open the window

   Home is arcanus.network. Connect a wallet the same way you would in any other browser on this site.

3. 03

   Use the protocol

   VPN, Voice, Mail, Messenger, Infer, and Shield are the same products. The browser is the quieter room they open in.

4. 04

   Keep your extensions

   Passwords, shopping, writing, extra privacy, themes, dictionaries. Language packs are the one type it will not install.

What is already on

The point of a network browser is that the private defaults are not optional homework. A new Arcanus profile already runs in strict tracking protection: no usage statistics, no studies, no “help us improve” prompts, HTTPS-only, partitioned cookies, tracker query-stripping, content blocking in ordinary and private windows, and no built-in chat or link summaries.

Websites still see a normal, current browser. Logins, video, and everyday web apps keep working. The window does not advertise a rare name that sites can use to single you out.

Its own chest

History and cookies live under the Arcanus name, not inside another browser’s profile. The crest is on the window, the icon, and the installer. Support is this site. If you need overrides, they go in an Arcanus config file on the machine — Windows: %USERPROFILE%\.arcanus\arcanus.overrides.cfg.

Browser questions

Infer is the Arcanus inference marketplace. You send a standard chat request. A node on the mesh answers. You pay the same way as VPN: $ARCANUS or native USDC on Arc, to the protocol treasury. Per token, with a signed ceiling — never a monthly seat, never an API key. Unused ceiling stays as Infer credit on the paying wallet.

This is our shop, on this site. The dashboard tab, the /v1 routes, the 402 quote, the GPU agent, and the credit ledger are Arcanus. Open GPUs connect out. A hosted seed can fill the catalog when no operator is online — Arcanus pays that seed; buyers still pay the treasury. The seed is not named in the product, and it is not the private lane.

Two tiers. Open is crowdsourced: anyone with a GPU can serve catalog models. Those nodes see prompts in the clear — do not send secrets there. Private is attested hardware: three times the open rate, sealed for a node that can prove what it is. That lane is listed now and returns unavailable until such a node exists. We will not pretend an ordinary process is an enclave.

Buy an answer

Fastest path: the dashboard Infer tab. Connect a wallet on Arc, pick Open, write a prompt. The first unpaid request quotes a ceiling. Pay with $ARCANUS or USDC — same buttons as VPN. The answer streams. Leftover ceiling is Infer credit on this 0x.

1. 01

   Ask

   Dashboard desk, or POST /v1/chat/completions with a catalog model. Same shape as a normal chat request.

2. 02

   Sign a ceiling

   HTTP 402 quotes the prompt plus max tokens, capped at 2 USDC. Pay that ceiling with $ARCANUS or native USDC to the treasury.

3. 03

   Stream

   The node streams the answer. Only delivered tokens settle. Leftover ceiling becomes Infer credit.

4. 04

   Keep the ticket

   A credit ticket lets a script reuse leftover USDC. The dashboard does this with the signed-in wallet.

How a request is billed

1. 01

   Before the request runs, Infer estimates the prompt at about four characters per token plus four tokens per message, and prices the prompt plus max_tokens of output. That price is the ceiling.

2. 02

   If the ceiling would pass 2 USDC, max_tokens is lowered until it fits. If the prompt alone leaves no room for output, the request is refused before any payment.

3. 03

   If this wallet already holds Infer credit, only the shortfall is quoted. You pay that shortfall to the treasury in $ARCANUS or native USDC — a transfer, not a card, not a facilitator.

4. 04

   The node streams. Delivered tokens are billed at the tier rate, rounded up to the nearest 6-decimal USDC unit, never more than the ceiling, never less than one unit. The rest stays as credit.

If the node stops mid-answer, only the delivered part is billed. If nothing arrived, the reserved ceiling returns as Infer credit. Funds always land in the protocol treasury first. Live operator GPUs then earn 90% of the settled amount on the node ledger.

From a script

Base URL is https://arcanus.network. /v1/* rewrites to the Infer API. CORS allows any origin and exposes PAYMENT-REQUIRED. Amounts in 402 bodies are 6-decimal USDC units for native USDC, plus $ARCANUS units when that asset is live. There is no Infer API key.

An unpaid request is refused with 402. The body lists accepted assets (treasury 0x, ceiling, quote id):

curl -i https://arcanus.network/v1/chat/completions \
  -H 'content-type: application/json' \
  -d '{"model":"llama3.2:3b","messages":[{"role":"user","content":"What does arcanus mean?"}],"max_tokens":64,"stream":true}'

Pay the quoted ceiling on Arc to the treasury 0x in the 402 body — native USDC (payAsset: "eth") or $ARCANUS (payAsset: "token"). Retry with a PAYMENT header (JSON, or base64 of that JSON):

curl -i https://arcanus.network/v1/chat/completions \
  -H 'content-type: application/json' \
  -H 'PAYMENT: {"quoteId":"…","txHash":"0x…","payer":"0x…","asset":"eth"}' \
  -d '{"model":"llama3.2:3b","messages":[{"role":"user","content":"What does arcanus mean?"}],"stream":true}'

The stream is OpenAI-shaped text/event-stream. After the last token, a chunk carries arcanus.settledUsdc, leftover credit, and a ticket. Then [DONE]. Send "stream": false for one JSON completion. Credit lives on the paying 0x — GET /v1/credits from the signed-in dashboard origin, or pass the ticket.

API reference

Requests and responses are JSON, except the chat stream. Errors are {"error":"…","code":"…"} when a code exists. Chat is limited to 40 requests per window per client.

Chat errors you will actually see: invalid_request (400) for a bad body or a prompt over the cap; node_unavailable (503) when no live GPU and no seed is attached, or when a private model is listed but not live; 402 when a ceiling is due; 409 if that tx was already used; 403 if the credit belongs to another wallet. Private models return 503 until an attested node exists — we do not take payment for a lane that cannot run.

Earn with a GPU

Open only. Run a catalog model on the machine. Start the Infer agent. It connects out to arcanus.network — no inbound port. Every settled answer credits that node 0x with 90% of what the buyer paid. Withdraw from the Infer GPU desk, from 1 USDC, signed by the same key.

1. 01

   Serve a catalog model

   llama3.2:3b, qwen2.5:7b, llama3.1:8b, or qwen2.5:32b on a local chat server (default 127.0.0.1:11434).

2. 02

   Start the agent

   NODE_PRIVATE_KEY is the payout 0x. ARCANUS_URL is this site. npm run infer-node from the repo.

3. 03

   Stay online

   The agent pulses and polls. Jobs arrive on that socket. The GPU desk shows online, models, and earnings.

4. 04

   Withdraw

   Sign arcanus-infer-withdraw on the GPU desk. Nonce must increase. If the payout wallet is dry, the balance is unchanged.

NODE_PRIVATE_KEY=0xYOUR_KEY ARCANUS_URL=https://arcanus.network npm run infer-node

The pulse is an EIP-191 personal_sign of the node message (domain, chain 5042, address, models, time). Withdraw signs arcanus-infer-withdraw:5042:address:units:nonce. Keep the key on the GPU. Never paste it into the site.

Catalog

Prices are USDC per million tokens. Input tokens cost half the output rate. Private ids are the same names with a private/ prefix, at 3×. Each request authorises at most 2.00 USDC. GET https://arcanus.network/v1/models returns the same table with live node counts. Operators take 90% of settled amount when a live node is attached.

Private inference

Private is the attested lane. The buyer asks for private/llama3.2:3b (and the other catalog names with that prefix). The node is supposed to prove what hardware it is, keep the prompt sealed for that enclave, and bill at 3×. Until a node can do that, the route returns node_unavailable and we do not collect a ceiling. We will not describe an ordinary GPU process as an enclave.

What stays private — and what does not

Infer is on-protocol because payment is the key and the wallet is the identity. There is no Infer login, no vendor API key, and the on-chain receipt is a transfer to the treasury — not the prompt. We do not write prompts or answers to the Infer ledger. After a GPU job finishes, the control plane drops the messages. Forget thread on the desk clears what is sitting in this browser.

That is not the same as Mail. On the open lane the GPU that answers can read the prompt. That is the honest cost of a crowdsourced node. Letters and secrets stay in Mail. Keys for VPN stay on the device. Infer does not pretend an ordinary process is an enclave.

Shield is a private USDC pool on Arc. You put native USDC in from one wallet. You take the same amount out to a different address with a private note. The deposit is public. The withdrawal is public. What stays hidden is which deposit paid which withdrawal. The new address already has gas, because on Arc the gas is USDC.

This is a separate desk from VPN, Voice, Mail, Messenger, and Infer. Those buy a city, a call, a letter, a thread, or an answer. Shield does not buy a service. It moves USDC from one 0x to another without leaving a public trail between them. Open it in the dashboard, or on the Shield page.

Get started

1. 01

   Connect a wallet on Arc

   The same login as the rest of the protocol. Shield only spends native USDC — the same asset that pays gas.

2. 02

   Pick 50, 100, 250, or 500 USDC

   Fixed amounts on purpose. A crowd of matching deposits is what makes a later withdrawal hard to pair.

3. 03

   Confirm, then keep the note

   Your browser writes one line of text. Copy it. Download it. That line is the only key. We cannot recover it.

4. 04

   Unshield anywhere

   Paste the note on any device, pick a fresh address, and withdraw. A proof made on your device shows you own one of the deposits without saying which.

The note is the key

After you shield, the site shows one line that starts with arcanus-shield-1. That is not a receipt. It is the secret. Anyone who has it can take the USDC. Anyone who does not, cannot — including us. Treat it like a seed. Screenshot it if you must, but keep that screenshot off shared cameras and chat threads.

You can unshield from a different browser, a different phone, a different week. Paste the note, type the destination, confirm. The proof is built on the device in front of you. The helper that pays the network fee never sees the note. It only sees a proof.

How the privacy actually works

A deposit is like walking into a crowded room. People can see you enter. They can later see someone leave with the same amount of cash. They cannot prove the person leaving is you, if enough other people walked in with the same amount and did not all leave at the same time.

1. 01

   You shield 50, 100, 250, or 500 USDC. That transfer is public on Arc, like any other.

2. 02

   Your browser keeps a private note. The chain stores a commitment — a lock that only the note can open.

3. 03

   Every new deposit is approved automatically, in the order it arrived. Nobody can skip you. Nobody can exclude you.

4. 04

   When you unshield, the device proves you own one lock in the pool without naming it. A helper pays the gas so the destination can already move.

Patience is part of the product. Unshielding the same amount a minute later is easy to pair with the last deposit. Wait until more people have put the same amount in. Split across amounts if you need to. The crowd is the cover.

What it costs

Putting USDC in is free beyond the network fee your wallet already pays. Taking it out costs a 0.25% helper fee plus gas, taken from the unshield itself. That is how a fresh address can receive funds without holding USDC first. The helper wallet never holds the pool. It only pays gas and is paid back in the same transaction.

Amounts are fixed: 50, 100, 250, or 500 USDC. That is not a limitation of the chain. Matching sizes is what makes the room crowded. Custom amounts would paint a unique number on your deposit.

Nothing to wait for

Every deposit is approved as soon as it lands, in order. There is no review queue, no person deciding who is allowed in, and no way for the operator to drop a label. The contract that publishes the approved set can only publish every deposit, sequentially. If it cannot do that, it cannot publish at all.

Honest limits

Deposits and withdrawals are on a public chain. Shield hides the pairing, not the fact that the pool exists. Timing still talks: the only 500 USDC in a quiet hour is a weak crowd. Amounts still talk: a unique size is a fingerprint. Do not treat this desk as invisibility. Treat it as a crowded room you chose to walk into.

This Arc deployment is new. Start with a small amount and a note you have actually saved. The original wallet can always take its own deposit back in public if something goes wrong and you still control that 0x.

Shield questions

Email, Google, Apple, or a wallet. If you have no wallet, an embedded Arc account is minted at the door. That 0x is your identity for VPN, voice, mail, messenger, Infer, and Shield. One login for the whole protocol.

The 0x is what other people dial, write to, and hold $ARCANUS against. Messaging installations and VPN keys are created on the device after that sign-in. Losing the device does not give us a copy of those keys, because we never stored them.

You send $ARCANUS or USDC to the protocol treasury on Arc. After the receipt, the control plane either hands you a VPN config or credits minutes. Infer quotes a ceiling in $ARCANUS or native USDC, paid to the treasury, and settles only the tokens delivered. There is no card network in the middle.

$ARCANUS is the protocol token — the primary way you pay and the asset used for Mail and Messenger hold checks. Checkout, wallet balances, and quotes all read that token on Arc. The $ARCANUS amount is quoted from the live market price so a USD total stays a USD total. Native USDC on Arc is gas (every token transfer still needs a little of it) and the secondary checkout.

A hold is not a spend. If a product asks you to hold 100 $ARCANUS, those tokens stay in your wallet. The control plane only checks the balance. A one-time unlock is a single treasury transfer, one wallet, one time — not a subscription.

Shield is not this checkout either. You put native USDC into a pool and take it out with a note — see Shield. Apps that want to charge per HTTP call use a separate helper. That is not this checkout. See Pay per request.

This is a separate rail from VPN, Voice, Mail, Messenger, Infer, and Shield. Pay-per-request is for any app that wants to charge a tiny USDC amount for one HTTP call.

The buyer signs a bill in their wallet. The seller asks us to check that signature and send it on-chain. We pay the network fee. The USDC goes from the buyer to the seller. We never hold it. The receipt is public on Arc.

What to point at

Helper URL: https://arcanus.network/api/x402

GET  https://arcanus.network/api/x402/supported
POST https://arcanus.network/api/x402/verify
POST https://arcanus.network/api/x402/settle

Live asset: official Arc USDC
Network: eip155:5042
Token:   0x3600000000000000000000000000000000000000

The buyer never calls those URLs. Only the seller does. Try the live 0.001 USDC bill on the pay-per-request page.

Arc is an EVM L1 with USDC as native gas. Chain id 5042 on public mainnet. Payments and identity live here. The VPN itself does not. Voice packets do not. Mail plaintext does not. That split is the point: a receipt is not a wiretap.

$ARCANUS is a token on this chain. Checkout, wallet balances, and quotes all follow that token. You can verify a payment on the Arc explorer the same way you verify any other 0x transfer.

We can see that a wallet paid, which city was requested, that a voice room existed, that two wallets exchanged encrypted mail, and — on Infer’s open lane — the prompt and the answer. On Shield we can see that a wallet put USDC in and that some address took USDC out. We cannot see which deposit paid which withdrawal, and we cannot see the note.

We cannot see your VPN private key, the websites you open through it, the audio inside a room, the plaintext of mail, or Messenger threads. Infer’s private lane is listed for attested nodes; it is not live yet, and we will not describe an ordinary process as an enclave.

A city operator sees encrypted packets from that session. They do not see your Arc wallet unless you publish it. They are not Arcanus. Pick cities you are willing to exit from — an exit node can observe traffic leaving that city the same way any VPN exit can.

A messaging delivery node sees ciphertext envelopes and routing topics. MLS authentication rejects a forged installation. Forward secrecy limits the blast radius of a later leak. Revoke a lost device from the recovery identity.

A voice forwarder sees that packets moved. Frame encryption means those packets are not a recording of the call. Signaling is metadata: who rang whom, that minutes were reserved. Metadata is not the conversation, but it is not nothing. Do not treat a privacy protocol as invisibility.

The public starting price for VPN is $0.09 per gigabyte. Packs are a shortcut, not a trap:

• 1 GB

  $0.09

  A focused session or a single download

• 20 GB

  $1.80

  Maps, chat, and video across days of use

• 100 GB

  $9.00

  Always-on privacy without a yearly plan

Before you confirm, the screen breaks the total into the location and the Arcanus fee. That is on purpose. You should see where the money goes.

Leftover invite points sit on your account toward upcoming giveaways. They do not discount the next payment.

Messenger is separate from gigabytes and minutes. Hold 300,000 $ARCANUS, or pay $5.00 once. Either lets this wallet send or reply. Incoming chat is always open. No per-message fee.

Mail is a second product on the same encrypted rail: a letter desk, not a chat. Hold 300,000 $ARCANUS, or pay $5.00 once. Either lets this wallet send or reply. Incoming mail is always open. No per-letter fee.

Infer is pay-per-token on Arc, same checkout as VPN: $ARCANUS or native USDC, paid to the treasury. You sign a ceiling of at most $2.00, the node streams, and only delivered tokens settle. Unused ceiling stays as Infer credit. Open models are public to the node. Private attested nodes are listed and not live yet. Infer is not Mail — secrets stay in the letter desk.

Voice is priced in USD per minute on the live list. Packs are typically 5 / 15 / 30 minutes. $ARCANUS is the protocol token at checkout; native USDC remains available as the secondary payment and as gas.

Arcanus Browser is the desktop window for the protocol — privacy on by default, home at arcanus.network. After VPN hands you a file, import it into the official tunnel apps. Arcanus does not ship a kernel driver in the browser. Voice, Mail, Messenger, Infer, and Shield run in the dashboard itself.

Write support@arcanus.network. Include the city, the tx hash, or the 0x — never a private key, never a seed.