@inproceedings{10.1145/3779208.3807489,
author = {Oren, Bartan and Caprolu, Maurantonio and Sciancalepore, Savio and Zannone, Nicola and Di Pietro, Roberto},
title = {From DePIN Hype to Operational Reality: Assessing Centralization and Usage of Commercial dVPNs},
year = {2026},
isbn = {9798400723568},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3779208.3807489},
doi = {10.1145/3779208.3807489},
abstract = {Decentralized VPNs (dVPNs) are marketed as a flagship use case of Decentralized Physical Infrastructure Networks (DePIN): a fully decentralized, censorship-resistant alternative to traditional VPNs, where users route traffic through a global pool of independently operated exit nodes. However, despite claims of decentralization and “military-grade privacy”, little is known in both the white and the gray literature about the actual commercial dVPNs architecture, their true level of decentralization, and what they are used for. To fill these gaps, in this work, we present the first data-driven, operator-centric study of commercial dVPNs. We deploy several fully functional exit nodes worldwide on two prominent dVPN platforms, Mysterium and Sentinel. Via such nodes, we collect control-plane traffic, user traffic, and publicly available metadata to assess what an honest-but-curious operator can infer about systems' architecture, effective decentralization, and real-world usage. Our findings challenge the dominant narrative. Architecturally, both investigated dVPNs rely heavily on centralized orchestrators, often hosted on a handful of Cloud providers. These components constitute clear chokepoints, making the networks more fragile, censorable, and way less decentralized than their branding suggests. From a usage perspective, traffic relayed by our nodes is dominated by mainstream, commercially oriented activities rather than by censorship evasion or privacy-motivated uses. Overall, we show that current commercial dVPNs inherit many centralized features of traditional VPNs while shifting trust and liability onto a heterogeneous, legally shaky, and largely untrusted operator base.},
booktitle = {Proceedings of the ACM Asia Conference on Computer and Communications Security},
pages = {52–67},
numpages = {16},
keywords = {Virtual Private Networks, DePIN, Privacy and Censorship Resistance, Network Robustness, User Study},
location = {
},
series = {ASIA CCS '26}
}