I. The €2,500 Myth

The prior cost estimate was built on a reasonable-sounding assumption: multiply the number of relays by the price of a decent VPS from a mainstream provider. A Hetzner CX21 costs €5.85/month. A DigitalOcean droplet costs $6/month. Multiply by 49 relays and you get a number that demands explanation — who is spending €3,000 a month on anonymous Tor exits?

The answer is: nobody. Because the estimate was built on the wrong price list.

The privacy hosting segment operates at price points that mainstream cloud users never see. These are not enterprise providers with marketing departments and SOC 2 compliance teams. These are sole traders and micro-LLCs running servers from residential addresses, accepting Monero, and competing on price in a market where the buyer has zero switching costs and zero loyalty.

The relay count itself requires revision. Current Tor Onionoo data confirms 27 active relays in the 2cb.su family, down from the "49+" cited in prior dossiers. Relays go offline, contact strings change, and the prior count may have included overlap with separate operators (like allium.top, which shares providers but is a distinct entity with a different XMR wallet).

II. The Self-Identification

The operator of 2cb.su has published a statement that most intelligence analysts would kill for:

Parse this carefully. First person singular. Present tense. Active voice. Not "we" — "I." Not an organization, not a collective, not a funded project. A single individual who runs relays and a Monero node. The phrase "privacy focused services" is self-classification into a specific community: the privacy-first, crypto-native, ideological wing of the hosting market.

The domain itself has migrated. Prior dossiers tracked 2cb.li — Liechtenstein, EU/EEA, cooperative with Western law enforcement. The new domain is 2cb.su — the Soviet Union's legacy top-level domain, now administered by RU-CENTER in Russia, historically resistant to Western seizure and takedown requests. The relay DNS still references 2cb.li (tor-exit.bg.2cb.li, tor-exit.nl4.2cb.li, etc.), but the operator's identity anchor moved to a jurisdiction that doesn't answer subpoenas from Frankfurt.

III. The Cryptocurrency Supply Chain

The most remarkable finding in this investigation is not what the money trail reveals, but what it doesn't. At no point in the entire supply chain — from the operator's wallet to the server racked in a Bulgarian data center — does a single euro, dollar, or any fiat currency change hands.

The Payment Processors

The Fiat Firewall

The Monero Wallets

Two XMR addresses are confirmed in live relay metadata:

• 85rXJTz... — 2cb.su operator (Satanist)
• 82sdVXSFUJcici5mP... — allium.top operator (separate entity)

Both start with 8, indicating subaddresses — derived from a primary wallet but cryptographically unlinkable without the view key. This is standard Monero privacy practice: generate a unique subaddress for each receiving context. The blockchain explorer shows nothing — Monero's design makes balances, transaction history, and sender/receiver linking invisible to anyone without the wallet's private view key.

This is a dead end by design. Not by accident.

IV. The Provider Economics

LAIN / aluy.net — The Legitimate German Host

Julian Achter's business is larger than the prior dossiers implied. The aluy.net pricing page reveals a full-service hosting company, not a boutique ASN shop:

This is not a loss-leader. With 114 Hetzner auction servers alone, even a 5% margin on wholesale Hetzner prices generates meaningful revenue. The LIR services (€71/year ASN sponsoring) were one line item — the VPS and reseller business independently sustains the RIPE NCC membership (€1,300-2,000/year). At 50+ active customers across all product lines, this is a profitable sole-trader operation.

The AUP explicitly permits Tor exit relays. LAIN is not a bulletproof host — it cooperates with lawful law enforcement requests. It simply doesn't discriminate against legal privacy infrastructure. The 2cb.su relays are paying customers, not favored clients.

1337 Services GmbH — The Backend That Survived

German GmbH (Gesellschaft mit beschränkter Haftung), Hamburg HRB 164175, registered in Wallenhorst. Operates AS210558. Public brand: RDP.sh. Minimum registered capital: €25,000 (German statutory minimum). This is not a shell company — it's a registered limited liability company with Handelsregister obligations including annual financial statements.

1337 Services hosts ≥2 2cb.su relays and ≥1 allium.top relay. It accepts 20+ cryptocurrencies via Cryptomus. The company name itself — "1337" (leet speak for "elite") — is cultural positioning, not evidence of criminality.

Aokigahara SRL / Kyun.sh — Zero Employees, Three Relays

The identity chain is now complete:

"Moe moe kyun" (萌え萌えキュン) is a catchphrase from the anime series K-On! (2009). "Aokigahara" is the Sea of Trees forest in Japan, historically associated with suicide. The company registered as a Romanian SRL — minimum capital 200 RON (~€40), no audit requirements for micro-entities, no minimum employee count. It is the lowest-cost, lowest-friction path to operating as an EU-based LIR.

Monerica's own reliability note is striking: "Use caution — Historically poor reliability. Romania location has previously had high downtime and USA location has had at least one data loss incident. Doesn't fully own all hardware." This is not infrastructure you'd trust with mission-critical services. It is infrastructure you'd use for relays where downtime is acceptable and individual server loss is routine.

MAXKO d.o.o. — The Invisible Provider

Croatian LLC (društvo s ograničenom odgovornošću), Skradinska 2, 44000 Sisak. Operates AS211619 with 31 IPv4 prefixes (7,936 IPs) and 76 BGP peers. Hosts ≥3 2cb.su relays across Bulgaria, Netherlands, and Hungary.

The critical finding: MAXKO d.o.o. has no public-facing hosting website. The domain www.maxko.org is an MMORPG gaming server (Knight Online private server) — a completely unrelated entity. The hosting company appears to operate as a pure wholesale/B2B infrastructure provider without retail marketing. This is the provider equivalent of a white-label manufacturer — the end product carries someone else's brand.

Throttle Limited (ex-StealthVM)

AS198189, Sweden. The StealthVM brand is dead — the domain is parked on GoDaddy with AdSense ads since at least 2019. But Throttle Limited continues to provide hosting on the same AS. The desolate relay (176.65.142.198, Sweden) runs on this infrastructure. The StealthVM story is a lesson in brand transience: the marketing wrapper disappeared, but the AS number and the servers persist.

V. The ASN Map

The 2cb.su relay network spans 14 confirmed autonomous systems across 9 jurisdictions. This is not diversification by accident — it is defense-in-depth against single-point seizure.

The geographic pattern reveals a design principle: concentrate relays in countries with strong data protection frameworks (Netherlands, Germany, Finland, Sweden, Switzerland) while registering companies in jurisdictions with minimal incorporation friction (Romania, Croatia, Nevis). The operator's own identity is anchored in a jurisdiction that doesn't cooperate with Western legal process (.su / Russia).

This is not a single-rack operation. This is distributed infrastructure deliberately spread across legal jurisdictions to ensure that no single law enforcement action can take down the network. When Operation Talent seized StarkRDP.io in January 2025, the 2cb.su infrastructure was untouched. Zero chilling effect — the RIPE NCC records for related ASes were modified as recently as June 2026.

VI. Legitimate vs. Anonymous — The Funding Comparison

How do the transparent Tor relay operators fund their work?

Every legitimate large-scale Tor relay operator has: a registered nonprofit, named leadership, published funding sources, and transparent governance. The 2cb.su operation has none of these. But it also doesn't need them — at €150-200/month, it falls below the threshold where organizational structure provides value. You don't incorporate a nonprofit to fund a hobby.

VII. The Exit Monetization Dead End

Could the operator be making money from the relays themselves?

No evidence of active monetization was found. At ~€150-200/month, monetization is unnecessary. This is the operational cost equivalent of a moderate dining-out habit for a European tech worker.

VIII. The Privacy Hosting Ecosystem

An important distinction emerges from this investigation: the 2cb.su network operates in privacy hosting, not bulletproof hosting (BPH).

This distinction matters legally and analytically. BPH providers like Yalishanda (CloudVPS) or AEZA Group knowingly facilitate criminal operations and charge premium prices for abuse tolerance. The providers in the 2cb.su ecosystem — LAIN, Kyun.sh, 1337 Services, BuyVM — offer standard hosting with privacy features (crypto payment, no-KYC) at commodity prices. They don't charge extra for protection because they don't provide it. They simply don't ask questions that mainstream providers do.

IX. The Big Question — Who Is Paying?

After following every financial thread available through public intelligence sources, the probability assessment converges on a single, anticlimactic conclusion:

X. What the Money Trail Reveals

This dossier set out to follow the money. What it found instead is a proof of concept for something far more significant than one person's relay hobby.

The 2cb.su network demonstrates that in 2026, it is operationally possible to:

• Obtain ASN resources through a €40 Romanian shell company
• Register domains through a Caribbean crypto-only privacy proxy
• Host servers across 14 autonomous systems in 9 countries
• Pay for everything in Monero through crypto-native payment processors
• Anchor your identity in a jurisdiction resistant to Western legal process
• Do all of this for less than €200 per month
• Do all of this without a single fiat currency transaction

The infrastructure is legal. The relays serve a legitimate privacy function. The operator isn't hiding from anyone — they're posting their XMR address in public relay metadata and self-identifying on their website. The financial opacity is not evidence of crime. It is a feature of the system.

And that is the finding that matters more than the identity of one pseudonymous relay operator. The fiat firewall is complete. The crypto-native infrastructure supply chain exists and is functional. The privacy hosting segment has matured to the point where commodity pricing, Monero payments, and API-provisioned servers make it possible for anyone — ideologue, criminal, intelligence service, or journalist — to operate globally distributed infrastructure with no financial footprint in the regulated system.

The money trail ends not because it was hidden, but because it was never denominated in money.