A VPN encrypts the traffic between your device and the provider’s server, then forwards it onward. That solves one problem well: nobody between you and that server can read what you’re sending, and the sites you visit see the provider’s IP address instead of yours. It leaves a second problem completely untouched. The pattern of your traffic — when packets leave, how many, how large — passes through the tunnel unchanged, and that pattern is enough to work out who is talking to whom. Security researchers call this traffic analysis, and encryption does nothing to prevent it.
The distinction matters because most of what surveillance actually runs on is not content but metadata: who contacted whom, when, how often, for how long. Michael Hayden, who directed both the NSA and the CIA, said in a 2014 debate: “We kill people based on metadata.”
Nym is a network built specifically to hide metadata. It is a mixnet — a design that predates the web, was abandoned for decades because nobody could pay for it, and has been revived with modern cryptography and a token that pays the node operators. This article covers how it works, mechanism by mechanism, and where it falls short.
The problem: timing survives encryption
Suppose an observer can see the traffic entering a VPN server and the traffic leaving it. Every packet is encrypted, and the observer cannot read any of it. They do not need to. Packets leave your machine in a distinctive rhythm — a burst when a page loads, silence while you read, another burst when you click. That rhythm arrives at the VPN and, milliseconds later, the same rhythm exits the other side towards a particular website. Matching the two rhythms links you to that site. The animation below shows the entry and exit timings side by side; the fingerprint is the spacing of the ticks.
Watching both ends of a connection is precisely what a state-level adversary can do, by tapping internet exchange points or buying netflow records in bulk from ISPs. Tor, for all its strengths, has the same weakness: its relays forward packets first-in-first-out as fast as they can, so timing passes through all three hops. The Tor Project has been open about this since the beginning — its design documents explicitly exclude the “global passive adversary” from the threat model. A mixnet is the design that takes that adversary on directly.
Where mixnets came from
David Chaum described the mix network in a paper submitted in 1979 and published in 1981, before TCP/IP was standardised. His idea was a chain of servers that each collect a batch of messages, strip a layer of encryption, reorder the batch, and forward it — so that the correspondence between what goes in and what comes out is destroyed at every hop. The cypherpunk remailers of the 1990s implemented this for email. They ran on volunteer machines, added hours of delay, and gradually died out: nobody was paid to keep them running, and few people would tolerate the latency.
The design that made mixnets practical again is Loopix, published in 2017 by Ania Piotrowska, George Danezis and colleagues at University College London. Loopix replaced batch processing with continuous-time mixing — each packet is delayed independently by a random amount — which brought latency down from hours to seconds while keeping the mathematical properties that make mixing work. Nym is Loopix built out as public infrastructure. The project grew out of two EU Horizon 2020 research programs (Panoramix and NEXTLEAP), demonstrated an alpha at the Chaos Communication Congress in December 2019, and launched its main network in April 2022. Some names attached to it are worth noting: Chelsea Manning audited the network’s security in 2021 and later joined as a consultant; the advisory board includes Daniel J. Bernstein and Bart Preneel; Edward Snowden gave the launch keynote.
The part of Nym that is genuinely new is not cryptographic. Mix nodes are paid, in a token called NYM, with node coordination handled on a Cosmos-based blockchain. Whether or not the token appeals to you, it addresses the specific reason every previous mixnet died: infrastructure run by unpaid volunteers does not stay up.
The route: five independently operated hops
Traffic through the Nym mixnet crosses five nodes: an entry gateway, three mix nodes drawn from three separate layers, and an exit gateway. Each node is run by a different operator, and the route is chosen fresh for each packet. The entry gateway knows your IP address but not your destination. The exit gateway knows the destination but not you. The three mix nodes in the middle know only the previous node and the next one.
Three mixing layers rather than one means no single operator, and no single legal jurisdiction, sits at a chokepoint. An adversary would need to control or observe a substantial fraction of all three layers before the mixing stops protecting you, and each honest node in a route resets the timing information to zero.
Sphinx: the packet format
Everything that travels through the mixnet is carried in Sphinx packets, a format from a 2009 paper by George Danezis and Ian Goldberg. Every Sphinx packet in the network has the same fixed payload size: 2048 bytes. A large file becomes many packets; a three-word message becomes one packet, padded to full size. Uniform size closes off an entire class of attacks — if packets vary in size, an observer can track a distinctive one across hops without reading anything.
The layering works as follows. For each of the five hops, the sending client performs a Diffie-Hellman key exchange against that node’s public key, using an ephemeral key carried in the packet header, and derives symmetric keys from the result. Each node uses its key to remove one layer of encryption, which yields the address of the next node and a packet that looks complete and full-sized — a node cannot tell whether it is the second hop or the fourth. Three details in the design reward attention:
- The ephemeral key is mathematically blinded at each hop, so two compromised nodes on the same route cannot compare the key material they saw and conclude they handled the same packet.
- The payload is encrypted with Lioness, a wide-block cipher in which changing any single bit of the ciphertext garbles the entire decrypted payload. An attacker who slightly corrupts a packet at one point in the network, hoping to spot the corruption emerging somewhere else, gets nothing usable.
- Fragments of a large message can each take a different route through the network and are reassembled at the destination.
The format also supports single-use reply blocks (SURBs) — pre-constructed packet headers a sender can hand out, which allow someone to reply through the mixnet without learning who they are replying to. The concept is in Chaum’s original 1981 paper.
Mixing: why the delays are exponential
A mix node does not forward packets in the order they arrive. Each incoming packet is held for a random delay and released when its timer expires, so the departure order has little to do with the arrival order. The delays are drawn from an exponential distribution, and the choice of distribution is doing real work here.
The exponential distribution is the only continuous distribution that is memoryless: the probability that a packet leaves in the next instant is the same whether it has been waiting ten milliseconds or ten seconds. Formally, P(T > s+t | T > s) = P(T > t). The practical consequence: an observer watching a mix node cannot improve their guess about which departing packet corresponds to which arriving one by tracking how long packets have been inside. Two packets that arrived in a known order leave in an order the observer cannot predict better than chance. Applied across three mix layers in sequence, the correlation between when you sent something and when it arrives is not merely blurred but statistically erased.
The delays involved are small — this is Loopix’s contribution, tunable latency — and the current NymVPN client exposes the setting directly: a “packet mixing profile” control that sets how long each mix node holds traffic, from 0 to 200 milliseconds per hop. The trade-off between latency and anonymity is handed to the user as a slider.
Cover traffic: hiding the fact of communication
Mixing hides which packet is which. It does not hide whether you are communicating at all. If your client only transmits when you are doing something, then the times you are active — online at nine, a burst at lunch, nothing after midnight — form a profile by themselves. Nym’s answer is cover traffic: the client sends a continuous stream of dummy packets, with the gaps between them drawn from a Poisson process, whether or not you are doing anything. When you have real data to send, it takes the place of dummies in the schedule. From outside, the stream looks the same either way, because every packet is an identically sized Sphinx packet.
The dummy packets serve a second purpose that I have not seen in other systems. Cover packets are loop packets: they are addressed, through the full mixnet, back to the client that sent them. A client therefore continuously verifies its own path through the network. If loop packets stop returning, something is interfering — either a fault, or an active attack such as an n−1 attack, where an adversary blocks or delays everyone else’s traffic to isolate a target’s packets and follow them through the mixing. The noise doubles as the alarm system. Mix nodes send their own loops as well, for the same reason.
Two client features shipped in 2026 fill in the picture. Mixnet Tuning lets users set the cover traffic rate, between 0.7 and 2 Mbps of decoy. Server Families warns when the nodes in a chosen route appear to belong to the same operator or sit in the same subnet — a quiet acknowledgement that “five independent hops” is only as true as the independence of the operators.
Paying without linking payment to use
A paid privacy service has an obvious contradiction to resolve: the payment record identifies you. Nym’s mechanism for this is the zk-nym, an anonymous credential scheme descended from the Coconut design, combined with offline e-cash. The flow: you pay — card, Bitcoin, Monero or Zcash — and a quorum of validators issues you a credential using blind signatures, meaning they sign it without seeing its contents. When your client later presents the credential to a gateway, it first re-randomises the signature, producing a version that is valid but cannot be matched to the one issued. Even if the validators and the gateway compare records, they cannot connect your access to your payment. The account itself is a 24-word recovery phrase; no email address or password exists anywhere in the system. Payments are converted to NYM tokens in a smart contract that pays the node operators.
Limitations
The honest accounting, because a privacy tool you have oversold is a privacy tool that gets someone hurt:
- Mixnet mode is slow, permanently. Five hops, deliberate per-hop delays and padding overhead put a floor under latency that no engineering will remove. Reviews consistently find it unsuitable for streaming or general browsing. It is built for traffic where metadata sensitivity outweighs speed: messaging, email, cryptocurrency transactions, source protection.
- The app’s fast mode is not a mixnet. NymVPN’s default mode is a two-hop tunnel over AmneziaWG, a censorship-resistant WireGuard variant — around 100 Mbps in tests, with no single operator seeing both ends, but none of the mixing or cover traffic described above. The two modes offer very different protections, and it is worth knowing which toggle you are on.
- The 2024 audit found serious issues. Cure53’s assessment — six auditors, 56 working days, full source access — recorded 43 findings, including 7 rated critical or high severity. All of the critical and high findings were fixed and the fixes verified. That is the audit process working as intended, but it is also a reminder that the implementation is younger than the theory.
- Academic critiques of the Loopix family exist. Published analyses have questioned how much cover traffic is enough, and pointed at the gateways — the least anonymous position in the architecture — as the pressure point if they are compromised.
- There is a token in the loop. Node operators are paid in NYM. That funds the infrastructure, and it also ties the network’s health to a cryptocurrency’s fortunes. Both things are true at once.
- Cost. About US$7.99 a month, or US$2.39–2.89 a month on longer plans, for 10 devices. The fair-use cap was raised this year from 2 TB a month to 25 TB a day. Post-quantum encryption became standard in June 2026.
Whether any of this applies to you
It depends on who you assume is watching. For changing your apparent country or keeping a café wifi operator out of your traffic, an ordinary VPN does the job and always did. For keeping your browsing away from your ISP and the advertising industry, Tor is free and has two decades of scrutiny behind it. A mixnet earns its costs when the adversary in your threat model can watch the network itself — tap exchange points, buy flow records, correlate timing at scale. Against that adversary, hiding content and IP addresses is not enough, because the traffic’s shape gives it away. Uniform packets, memoryless delays and constant noise are currently the only deployed defence aimed squarely at that problem.
Chaum worked the design out more than four decades before the surveillance infrastructure it counters existed at scale. What was missing all that time was not better cryptography. It was a way to pay for the servers.
Sources
- Nym Docs — Network Architecture (2026)
- Nym Docs — Sphinx Packet Format (2026)
- Nym Docs — Packet Mixing (2026)
- Nym Docs — Cover Traffic (2026)
- Nym Docs — zk-nym Credentials (2026)
- Chaum — Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms (1981)
- Danezis & Goldberg — Sphinx: A Compact and Provably Secure Mix Format (2009)
- Piotrowska et al. — The Loopix Anonymity System (2017)
- Wikipedia — Nym (mixnet) (accessed July 2026)
- Nym — Response to the Cure53 Security Audit (2024)
- TechRadar — NymVPN Mixnet Tuning and Server Families update (2026)
- WebProNews — NymVPN 2026 update (2026)
- Kripesh Adwani — NymVPN Review (2026)
- GitHub — nym-vpn-client (accessed July 2026)
- The Block — NymVPN zero-knowledge payments (2025)
- FOSDEM 2026 — NymVPN: The First Real-World Decentralised Noise-Generating Mixnet (2026)
- Just Security — “We kill people based on metadata” (2014)