Martti Malmi, one of Bitcoin’s earliest developers who worked directly with Satoshi Nakamoto in the protocol’s founding years, has released a new version of Nostr VPN — an open-source mesh VPN that discards the entire trust model underlying conventional virtual private network services and replaces it with cryptographic keys, decentralized relay infrastructure, and user-operated exit nodes.
The structural flaw at the center of commercial VPN services is straightforward. When a user connects to NordVPN, ExpressVPN, ProtonVPN, or any equivalent service, all internet traffic routes through servers owned and operated by that company. The user trusts the provider not to log, analyze, sell, or hand over that traffic to third parties — including law enforcement.
That trust has been violated repeatedly across the industry. Multiple VPN providers marketed as no-log services have subsequently been shown to maintain logs when compelled by legal process, per documented cases cited in the TFTC post.
The promise of privacy in a conventional VPN is only as strong as the company behind it — a company with employees, legal addresses, server infrastructure, and obligations to comply with the jurisdictions they operate in.
What Nostr VPN Does DifferentlyNostr VPN eliminates the central server entirely. The architecture operates as a peer-to-peer mesh network — devices connect directly to each other rather than routing through a corporate intermediary. The Nostr protocol handles signaling between nodes using public-key cryptography, the same cryptographic framework that secures Bitcoin transactions, per the project’s repository. Each user’s identity on the network is a cryptographic key pair, not an account or email address tied to a real-world identity.
The exit node model is where the practical privacy advantage becomes concrete. A user designates one of their own devices — a home server, a rented VPS from a provider like Hetzner, or any machine they control — as the exit point for their internet traffic. Websites and services see only the IP address of that exit node, not the device actually being used. The critical distinction from a commercial VPN is that the user is the operator. There is no third party between the user and the exit node who could be compelled to produce logs, because no third party holds them, per the project documentation cited in the TFTC post.
Why A Bitcoin Developer Built ThisMalmi’s involvement is not coincidental. The philosophy underlying Nostr VPN maps directly to the same sovereignty argument that animated Bitcoin’s original design — the elimination of trusted intermediaries from a system where that trust represents both a single point of failure and a single point of control. Bitcoin removed trusted third parties from money. Nostr VPN applies the same logic to internet privacy infrastructure.
The Nostr protocol itself was built by and for the Bitcoin community from its earliest days, using the same public-key cryptographic primitives and attracting developers who share a specific set of convictions about censorship resistance, self-custody, and the dangers of centralized infrastructure that can be pressured, subpoenaed, or shut down.
The release arrives as governments across multiple jurisdictions — including the United Kingdom, per recent legislative developments — move to tighten controls over VPN usage and expand surveillance capabilities. For the nascent sector’s community of privacy-focused users, developers, and holders for whom financial privacy and internet privacy are inseparable concerns, Nostr VPN represents a meaningful step toward infrastructure that cannot be compelled to betray its users — because there is no operator left to compel.
Cover image from Grok, BTCUSD chart from Tradingview
