Mix Networks Friday — August 21 2026 Weekly Update

Weekly companion to the Mix Networks 2026 Research and Deployment Tracker and Overview - Mix Networks. This edition is dominated by mixnet adoption and mixnet accountability: Nym landed its second major real-world wallet integration in a month (Peach Bitcoin, the first P2P Bitcoin marketplace with native mixnet routing, Aug 17) while an academic paper we missed at publication — "Analysis and Attacks on the Reputation System of Nym" by Xinmu Alexis Cao and Matthew Green (ePrint 2026/101) — demonstrates framing attacks against the very reputation machinery that makes Nym's mixnet safe. On the infrastructure side, Nym's Directory Contract PR stack (on-chain, LtHash-verifiable node directory) is a direct architectural answer to the corporate-centralization critique documented in the August 14 update, and shipped in the v2026.16-como release alongside the new nym-lthash crate. Tor shipped Browser 15.0.20 and Tails 7.11 on the security-rebase cadence, the relay network quietly grew to 10,128 running relays, Katzenpost resumed commits with operational-maturity work, and a fresh ePrint (Verifiable SelfMix, 2026/1617) proposes a new bulletin-board anonymity architecture.

TL;DR — This Week

• Nym × Peach Bitcoin: Peach — a Swiss, non-custodial, no-KYC P2P Bitcoin marketplace — natively integrated the Nym mixnet (announced Aug 17, 2026), making it the first peer-to-peer Bitcoin marketplace with native mixnet integration. Free for every Peach user, in-app toggle, five-hop routing (entry gateway → 3 mix layers → exit gateway), user-selectable exit countries, and a "Test current country" verifier. This is the second major wallet integration after Edge Wallet (mid-July) and the strongest evidence yet for Nym's "plug-and-play Layer 0" thesis: mixnet routing is becoming an embeddable privacy feature, not a product you switch to.
• Research — Nym reputation system is attackable (vault catch-up): ePrint 2026/101 (Cao & Green, Johns Hopkins; published Jan 21, 2026 — predates this weekly series, now documented) shows via source-code analysis, mainnet data collection, and a custom simulator that Nym's node-performance measurement is vulnerable to a "framing" attack: a small number of low-stake nodes can damage the scores of high-reputation active-set nodes, letting a moderately resourced adversary capture a fraction of the active set and enabling connection de-anonymization. Timing is sharp: this same week Nym merged PR #7073 — a new config-score penalty in the same reputation machinery the paper attacks.
• Nym Directory Contract — the decentralization answer: The open PR stack (#6933 Directory Contract, #6936 verifiable retrieval, #6948 attested anchor, #7013 node publishing) moves node-info distribution from per-node HTTP pulls to an on-chain push model — each nym-node pushes ed25519-signed config to a CosmWasm contract, with an incremental on-chain LtHash digest making whole-directory retrieval verifiable. This directly addresses the "one corporation gates the network" critique from the Aug 14 update. The standalone nym-lthash crate (LtHash16, 2 KB BLAKE3-XOF accumulator) shipped in v2026.16-como (Aug 18–19).
• Tor: Tor Browser 15.0.20 (Aug 18, by ma1ster) rebases stable onto Firefox 140.14.0esr with security fixes backported from Firefox 154, libevent 2.1.13, and a new signing subkey. Tails 7.11 (Aug 19) picks up 15.0.20 and fixes Persistent Storage activation failures (#19913). No 16.0a10 yet — the alpha line holds at 16.0a9. Network grew to 10,128 running relays (Aug 18; ~3,282 exits, ~5,882 guards) — up from the ~9,000 cited at DEF CON 34.
• Katzenpost: Development resumed Aug 14–15 after the quiet period noted last week — but the commits are operational maturity, not features: servers now withdraw from consensus before shutdown (#1092), graceful shutdown aborts on a second SIGINT/SIGTERM, the PKI documents StopAdvertising liveness dependencies, and the replica proxy semaphore tests were deflaked (#1093). Read: the codebase is being hardened for long-running federated deployments.
• Research — Verifiable SelfMix (ePrint 2026/1617, Aug 5): New anonymity architecture for placing messages in a public bulletin-board table with unconditional individual verifiability. Separates oblivious slot allocation (UNS) from anonymous message placement (SMPP); instantiates with TEEs or plaintext-equivalence tests, ElGamal/BGN/FHE; an FHE variant cuts client upload to Õ(log m). Relevant to Nostr-style append-only relays, mempools, and any ordered public log needing sender anonymity.
• Nym / NymVPN: v2026.12.1-beta.1 (Aug 19) and beta.2 (Aug 20) client releases; Geo Exclusion split-tunneling documented Aug 19 — a local SOCKS5 proxy placed outside the VPN tunnel routes traffic to selected regions directly (initially China IP ranges) while everything else stays protected. It's the "my banking app breaks on VPN" fix, beta, desktop-first.
• Snowflake Volunteer 1.12 (Aug 10): added Czech and Persian — the censorship-circumvention proxy app now ships in 10 languages (8 as of the Aug 14 update).
• I2P: Steady state. Five commits since Aug 13, all in i2psnark (the built-in BitTorrent client) — metainfo v2 WIP, memory-safety fixes in torrent piece handling, BDecoder duplicate-key hardening. No release; 2.13.0 (Jul 24) remains current, 2.14.0 targeted late October.
• Freedom-tech takeaway: The week's two biggest stories are two sides of one coin. Adoption is arriving (Peach, Edge, Zcash Ironwood free tier) — mixnet routing is winning real integrations exactly as Nym predicted. Accountability is arriving too — Cao & Green's paper shows the reputation layer that allocates mixing power is manipulable, and Nym's answer (on-chain verifiable directory + LtHash digests) is a credible architectural response, but the framing-attack problem lives in performance measurement, not directory storage. A mixnet is only as trustworthy as the mechanism that decides which nodes carry traffic. That mechanism is now the active battleground — for Nym, for I2P's Sybil recovery history, and for any reputation-enhanced anonymity network.

The Week in Detail

Nym × Peach Bitcoin: The First P2P Bitcoin Marketplace on a Mixnet

Peach Bitcoin announced native Nym mixnet integration on August 17, 2026 (Nym blog post, "The Nym mixnet now protects your Bitcoin trades in Peach"). This is the most significant real-world mixnet adoption event since Edge Wallet's integration in mid-July, and it extends the pattern from wallets to marketplaces — an application category where metadata leakage is directly monetizable by adversaries.

What Peach is: A Swiss, non-custodial, peer-to-peer Bitcoin marketplace. No registration and no ID where local law permits; open-source code; coins held in 2-of-2 multisignature escrow so Peach cannot move funds unilaterally. It removes the identity layer that centralized exchanges are built on — but, as the announcement correctly notes, no marketplace can remove on its own the metadata of transactions: an ISP or network observer can still tie an IP address to every order placed.

What the integration does: With the mixnet toggle on, Peach's traffic takes the full five-hop Nym path — entry gateway → three layers of mix nodes → exit gateway — buried in the network's cover noise. Two user-facing controls matter for the threat model:

• Allowed exit countries: the user chooses which countries the mixnet may exit through — essential when a payment method or counterparty is region-sensitive. (This is the user-controlled geo-availability first shipped as NymVPN's geo-exclusion; see below.)
• Test current country: an in-app verifier showing which exit the connection is actually routing through — making the protection verifiable from inside the app rather than taken on faith. Small feature, significant precedent: verifiable exit is exactly the kind of trust-but-check UX anonymity products have historically lacked.

The integration is free for every Peach user — Nym's mixnet usage economics are being carried by the network/operator side, not passed to the end user, at least for this flagship integration.

Why this matters beyond Bitcoin: Following Edge Wallet (multi-asset wallet, mid-July), this is the second production integration in roughly a month where mixnet routing ships as an embedded feature inside an existing product rather than a separate app the user must adopt. Nym's framing — "plug-and-play Layer 0 anonymity network" — is becoming testable: if wallet and marketplace integrations continue at this cadence, the mixnet's anonymity set grows with each integration's user base, which is the only sustainable path for cover-traffic economics. The counterweight is Cao & Green's paper (below): each integration concentrates de-anonymization value in the active set of mixnodes, making the integrity of the node-selection mechanism proportionally more critical.

Primary Sources: - Nym announcement (Aug 17, 2026): https://nym.com/blog/peach-bitcoin-mixnet-integration - Peach Bitcoin: https://peachbitcoin.com/ - Prior art in vault: Mix Networks Friday — July 17 2026 Weekly Update (Edge Wallet integration)

The Catch-Up Paper: Cao & Green Show Nym's Reputation System Is Attackable

The most consequential document added to this library this week is also its oldest: "Analysis and Attacks on the Reputation System of Nym" (ePrint 2026/101, Xinmu Alexis Cao and Matthew Green, Johns Hopkins University; published January 21, revised January 25, 2026). It predates the start of this weekly series (June 19) and had not been documented in this library — a significant omission now corrected, because it is the sharpest public security analysis of Nym's incentive machinery in existence.

Method: The authors combined three approaches — source-code analysis of the Nym implementation, data collection from Nym mainnet, and network simulations with a custom-built simulator.

Core findings:

1. Framing attack on performance measurement: The mechanism Nym uses to measure node performance is vulnerable to a form of framing attack in which a small number of low-stake nodes can damage the score of high-reputation active nodes. The measurement layer — which decides who stays in the active set — trusts interactions with nodes that can enter cheaply.
2. Active-set capture: Via these attacks, a moderately resourced adversary (explicitly not a nation-state budget) may gain control of a fraction of Nym Mixnet's active set. The paper notes this condition may enable connection de-anonymization attacks — the end-to-end break the whole architecture exists to prevent.
3. The survivability dilemma: The paper's framing generalizes beyond Nym: nodes' reliability measurement in reputation-enhanced networks faces an inherent tension — the entry of low-reputation nodes is required for network survivability (new operators must be able to join), but open entry grants attackers a platform to launch attacks against the network's own scoring system.

Why this matters this week specifically: On August 19, Nym merged PR #7073 — "add config score penalty for nodes incapable of sending nyx transactions" — a change to the same reputation-scoring subsystem the paper attacks. The network's core defense is under active development and under documented active-attack pressure. Meanwhile the Directory Contract stack (next section) decentralizes directory storage and verification, which addresses who-gates-the-network but not the performance-measurement integrity problem — the framing attack lives in the monitoring layer, not the directory layer. These are complementary fixes for different parts of the trust problem, and only one of them currently has a shipped architectural answer.

Vault cross-currents: This paper lands on three established threads:

• The Nym centralization debate (Aug 14 update; Privacy Guides "privacy theater" thread) — the paper shifts the critique from governance to mechanism: even a perfectly governed network with an attackable scoring layer fails its users.
• The Kimwolf Sybil incident on I2P (Feb 2026, ~700,000 hostile nodes; see I2P) — both cases demonstrate that open-membership anonymity networks are Sybil battlegrounds, but Cao & Green show the quiet version: no flood required, just patient score manipulation.
• The MOCHA insight (ePrint 2025/861, covered in Mix Networks Friday - Global Passive Adversary Defense and Research Frontier) — anonymity-set engineering must be measured empirically, not assumed. Cao & Green extend that discipline from mixnet parameters to reputation mechanisms.
• The trust-graph connection — reputation scoring of infrastructure nodes is structurally the same problem as WoT trust scoring of social accounts: both must resist framing/Sybil while remaining open-entry for survivability. The Proof of Personhood field exists because this problem has no cheap solution.

Citation: Cao, X.A., Green, M. (2026). "Analysis and Attacks on the Reputation System of Nym." IACR ePrint 2026/101. https://eprint.iacr.org/2026/101

Nym Directory Contract: Decentralizing the Directory with LtHash

The August 14 update documented the centralization critique: a single corporation (Nym Technologies SA) can gate the entire network through credential issuance and directory control. This week the architectural counter-response became visible in the codebase.

The PR stack (all open as of Aug 21):

The architectural flip: Node-info distribution moves from per-node HTTP pulls (a client must fetch config from each node — chokepoint-prone, spoofable, and the operational reason a central directory service exists) to a push model: each nym-node pushes its ed25519-signed configuration (keyed by (node_id, label)) to an on-chain smart contract, and consumers read the directory from chain.

The verifiability mechanism — LtHash: An incremental on-chain LtHash digest over all entries makes whole-directory retrieval verifiable. LtHash is a homomorphic multiset hash: the digest of a set of entries can be updated additively as entries are added or removed, without recomputing over the whole set — exactly the property an on-chain directory needs, where every state transition is gas-metered. The primitive shipped this week as the standalone nym-lthash crate (PR #7025, merged Aug 4, released in v2026.16-como): LtHash16, a 2 KB accumulator, BLAKE3 as the XOF, generic over the extendable-output function, with add/subtract multiset operations, serialization, and stability validation. It was extracted verbatim from the directory PR stack to merge independently.

What this does and doesn't solve:

• Solves: The directory stops being a corporate chokepoint. Node existence, configuration, and topology become on-chain, signed, and independently verifiable. A coerced or compromised Nym Technologies SA can no longer silently rewrite who the network is — the blockchain is the source of truth. This also strengthens the re-DKG path (PR #7082, "making future re-DKG smoother," opened this week) — distributed key generation events get harder to manipulate when the participant set is contract-published.
• Doesn't solve: Where nodes are is only half the question. Which nodes carry traffic — the active set, selected via staking and performance scoring — remains governed by the reputation machinery that Cao & Green show is framable. On-chain verifiability of the roster does not confer integrity of the measurements that rank the roster.

Release vehicle: The contracts and crate landed in Nym binaries v2026.16-como (changelog dated Aug 18, GitHub release published Aug 19), which also carries the Como Network Details v2 endpoint type (#7052), BandwidthController background global-data fetching with global-data-aware readiness (#6988), and a TS SDK 0.2.1 patch release with smoke-gate CI fixes (#7079, Aug 20).

Primary Sources: - PR #6933 (Directory Contract): https://github.com/nymtech/nym/pull/6933 - PR #7025 (nym-lthash crate): https://github.com/nymtech/nym/pull/7025 - v2026.16-como release: https://github.com/nymtech/nym/releases/tag/nym-binaries-v2026.16-como - LtHash (original): Bellare, Ristov; "Hash Functions Based on Three Permutations: A Generic Security Analysis." and Claus P. Schnorr's earlier multiset work; production lineage via Meta's LtHash (https://github.com/facebook/fbthrift main documentation) — Nym's implementation is BLAKE3-XOF-based.

Tor: Browser 15.0.20, Tails 7.11, and a Quietly Growing Network

Tor Browser 15.0.20 (August 18, 2026, released by ma1ster):

• All platforms: rebase onto Firefox 140.14.0esr (tor-browser#45204) and security fixes backported from Firefox 154 (tor-browser#45219).
• Android: GeckoView updated to 140.14.0esr.
• Build system: libevent updated to 2.1.13 (tor-browser-build#41839, propagating the August libevent security release); keyring updated for a new signing subkey and extended main-key expiry (tor-browser-build#41850) — routine but worth noting for anyone verifying signatures with a stale keyring; Go updated to 1.25.13.
• The stable line continues its security-rebase cadence; the alpha line is unchanged at 16.0a9 (no 16.0a10 this week).

Tails 7.11 (August 19, 2026):

• Updates Tor Browser to 15.0.20.
• Fixes Persistent Storage activation failures on some computers (#19913) — the persistence layer being the component that makes Tails usable for journalists and the threat populations this library's censorion resistance stack serves.
• Automatic upgrades available from Tails 7.0+.

Network size: The relay consensus reached 10,128 running relays on August 18 (~9,902 Fast, ~8,718 Stable, ~5,882 Guard, ~3,925 HSDir, ~3,282 Exit). At DEF CON 34 (Aug 9) Dingledine cited ~9,000 — the network added roughly a thousand relays in about a week, though whether this is durable growth or oscillation will only be clear from the 30-day trend. Against the DEF CON warning (Hetzner concentration, "trading safety for speed"), raw relay count is the wrong metric alone — geographic and provider diversity is the number that matters, and that is not yet visible for this cohort of new relays.

Snowflake Volunteer 1.12 (August 10): Added Czech and Persian language support plus dependency updates — bringing the app to 10 languages (was 8 at the Aug 14 update). Persian support in a censorship-circumvention proxy app is pointed: Iran is among the highest-value deployment environments for Snowflake-style bridges.

Arti: No new release; 2.5.1 (Aug 3) remains current. The relay/directory-authority milestones continue in development per the Aug 14 coverage.

Primary Sources: - Tor Browser 15.0.20: https://blog.torproject.org/new-release-tor-browser-15020/ - Tails 7.11: https://tails.net/news/version_7.11/ - Relay metrics: https://metrics.torproject.org/ (relayflags.csv, 2026-08-18) - Snowflake Volunteer 1.12: https://github.com/blocoio/snowflake/releases/tag/1.12

Research: Verifiable SelfMix — Bulletin-Board Anonymity (ePrint 2026/1617)

A new architecture paper published August 5 (revised Aug 6), "Verifiable SelfMix" (ePrint 2026/1617), proposes an anonymity mechanism orthogonal to both mixnets and DC-nets.

The problem it targets: placing messages into a public bulletin-board table — an append-only, publicly-readable ordered structure — without revealing which user wrote which slot. This is precisely the shape of Nostr relays, blockchain mempools, transparent logs, and public comment systems: anonymity research rarely addresses these directly, defaulting instead to network-layer solutions (Tor/mixnets) that leave timing correlation on the table.

The construction: VSM separates two concerns:

1. Unique Number Selection (UNS) — assigns each user a distinct hidden location in the table. Instantiated via trusted hardware or multi-server plaintext-equivalence tests.
2. Secure Mapping of Private Permutation (SMPP) — places each encrypted message at its assigned location without revealing the user-to-location mapping. Instantiated via ElGamal, Boneh–Goh–Nissim (BGN), and a theoretical FHE construction.

The distinctive property: Because each user learns their own final location, VSM provides unconditional individual verifiability after the table is decrypted — a user can check that their message landed where it should have, without trusting any server. Anonymity, integrity, and self-verifiability are proven in a static malicious model.

Costs: For n users and m slots, the vector-based SMPP constructions require O(m) ciphertext upload per user and O(nm) public aggregation — heavy; the FHE variant reduces client upload to Õ(log m) for fixed-size messages. This is early-stage theory, not a deployable library.

Vault relevance: The bulletin-board model is the correct abstraction for the Nostr ecosystem (WoT attestations, NIP-85 reviews) and for any future transparent-log reputation system — and the individual verifiability property composes naturally with the trust-graph work in OpenPGP Web of Trust and Nostr Web of Trust. It also connects to PIR thinking: both fields are converging on "public structure, private access pattern" as the design center.

Citation: "Verifiable SelfMix." IACR ePrint 2026/1617 (Aug 5, 2026). https://eprint.iacr.org/2026/1617

Katzenpost: Commits Resume, and They're All Operational Maturity

Last week's update noted Katzenpost had gone quiet since July 15. That ended August 14–15 with a cluster of merged PRs — and their content is diagnostic of the project's phase:

• #1092 — server: withdraw from consensus before shutdown: A shutting-down server now cleanly removes itself from the consensus document rather than disappearing. For a federated mixnet, graceful departure is what preserves anonymity-set honesty: users must not route through nodes that are going away mid-stream.
• Graceful shutdown abort: cmd/server now aborts the graceful shutdown on a second SIGINT/SIGTERM — the standard operator escape hatch for stuck shutdowns, straight out of production-ops playbooks.
• PKI documentation: StopAdvertising wait/liveness dependencies are now documented in the pki package — API contracts for how a node exits the directory.
• #1093 — replica: deflake the proxy semaphore scope tests: test-suite stabilization, the unglamorous work that indicates CI is being taken seriously for long-running development.

No releases (v0.0.99 remains latest tag); the Pigeonhole scattered-storage and QUIC transport tracks from previous updates continue beneath these housekeeping commits. The pattern matches the Katzenpost characterization in the tracker: research-grade infrastructure being slowly hardened toward federated deployment — now visibly in the operational-hardening phase.

Primary Sources: - Commit history: https://github.com/katzenpost/katzenpost/commits/main (Aug 14–15, 2026) - PR #1092: https://github.com/katzenpost/katzenpost/pull/1092

Quick Hits

• NymVPN v2026.12.1-beta.1 (Aug 19) / beta.2 (Aug 20): Rapid beta iteration on the desktop/mobile VPN client, tracking the v2026.16 core. Repo: https://github.com/nymtech/nym-vpn-client/releases
• NymVPN Geo Exclusion (Aug 19 blog): Beta split-tunneling-by-destination — NymVPN starts a local SOCKS5 proxy placed outside the VPN tunnel; requests pointed at it are sorted by destination (excluded regions go direct, everything else stays tunneled). Initially available for IPs in China, desktop-first (macOS/Windows/Linux), not yet on iOS; requires SOCKS5-capable apps; Android users are directed to standard split tunneling instead. This is the "my banking app won't work through a VPN" answer for censored-market users — the last-mile usability gap that makes or breaks VPN adoption in exactly the geographies that need the mixnet most. https://nym.com/blog/geo-exclusion-split-tunneling
• I2P i2psnark v2 WIP: Five commits since Aug 13, all in the BitTorrent client — metainfo v2 support (enum for metainfo types, "v2 WIP part 5"), memory-safety in torrent creation/rechecking (don't load whole pieces in memory), BDecoder duplicate-dictionary-key rejection, metainfo attribute extraction fixes. Commit log: https://github.com/i2p/i2p.i2p/commits/main
• i2pd (PurpleI2P): Active as of Aug 21 push; 2.61.0 (Jul 20) remains the latest release. https://github.com/PurpleI2P/i2pd
• nym-network-status UI deps: v2026.16 also carries a sweep of dependency bumps in the node-status UI and wasm examples — routine, but the forbid direct slice indexing in core crypto crates lint (#6983) is the notable one: a hardening rule preventing panics-on-slice-length in cryptographic code paths.

Evidence at a Glance