What this is, what it proves, and where the honest edges are.
What is this, in one sentence?
A layer that lets you move data across intermittent, multi-hop links you do not control, and prove later, offline, that it arrived intact, in the right order, through a known chain of custody, and was paid for. It rides delay-tolerant networking and settles on BSV.
Do I really need a blockchain just to move data?
No, and it does not move the data for you. The transport is standard
Bundle Protocol v7. What BSV adds is the settlement and provenance: delivery is bound to a real payment, and the data's root is anchored on chain so anyone can later verify what was delivered and paid, without trusting the relays or a central server.
What does this add that DTN itself doesn't?
The Bundle Protocol standardizes how data moves through intermittent networks, but it defines no native payment, incentive, or economic model, and its security extension, BPSec, protects the integrity and confidentiality of the bundle's contents rather than recording who held it along the way. It does not answer who paid for a delivery, or how you prove offline, a session later, the custody chain the data passed through. That settlement and verifiable-custody layer is exactly what this adds, on top of the standard, not instead of it.
How does a node a light-day away know which keys to trust?
It holds only its operators' root keys. Every other key arrives inside ordinary bundles as a record signed by the operator, with a role and a validity window, and revocations ride along the same way, so news of a lost key travels as fast as the traffic. A stolen key cannot fake the past either: each receipt commits to the ones before it, so a backdated signature is refused unless an honest node saw it in time. No online authority is involved (
how it works).
Does it replace the radio, satellite, or sonar?
No. The physical link (RF, optical, acoustic, coding, FEC) is explicitly out of scope. This is the trust, custody, and settlement layer that sits on top of whatever carries the bits. That boundary is the point, it makes the layer rail- and medium-agnostic.
What does a verifier actually check?
Four things, and it refuses if any fail: the content address recomputes, the signature recovers to the expected key, each delivered chunk verifies against the Merkle root, and delivery is bound to the settlement you paid. That last part matters: a receipt is a bearer object until you check its settlementRef against the transaction you actually paid. An unbound check refuses rather than passing.
How is this different from BPv7 custody transfer?
BPv7 (RFC 9171) has no custody transfer of its own; reliable hop-by-hop transfer is handled separately (bundle-in-bundle encapsulation, BIBE). Custody transfer answers "who must retransmit now". These receipts answer a different question: "who can prove they held this bundle, and when". Each custodian signs a receipt that travels with the bundle and can be checked by anyone, later, offline. They are not BPv7 administrative records and they complement custody transfer rather than replace it.
Is it only for space?
No. Delay-tolerant networking was built for intermittent, disrupted links generally. The same constraints appear in the ocean (subsea and AUVs), the sky (drones and stratospheric relay), and on Earth (disaster mesh, evidence chain-of-custody, environmental measurement). Deep space is just the extreme case.
What does the on-chain anchor prove?
That a specific data root existed and was committed at a point in time, tamper-evidently, independent of every relay the data crossed. Re-derive the Merkle root from the delivered payload and it matches the value in the transaction's OP_RETURN. It does not prove the data is correct, only that it is the data that was anchored.
How much does settlement cost?
A few satoshis to a few tens of satoshis in miner fees. In our mainnet run at 100 sat/kB, a paid receipt in its own transaction cost about 29 satoshis in fees (897,665 for all 30,502); batching 100 payments into one transaction brings that to roughly 7 satoshis each by size. That low floor is what makes per-hop settlement practical, which is not feasible when a single transfer costs more than the data is worth.
Which DTN stack does it use?
Any BPv7 stack. The receipts travel in an extension block that stacks which do not know it forward unchanged, tested through
µD3TN,
NASA HDTN,
JPL ION and
Aalyria Hardy, and along one path through µD3TN and then HDTN. The custody agent runs beside whichever stack you use.
Is this a standard?
It is written up as an individual IETF Internet-Draft,
draft-bsvkey-dtn-custody-receipt-block, with this repository as the reference implementation. An individual draft is a public proposal, not an IETF standard and not adopted by a working group.
Is DTN a real standard, or just research?
Both, and it is deployed. The term was coined by Kevin Fall in 2002, growing out of Vint Cerf's Interplanetary Internet work with ARPA/DARPA lineage. Bundle Protocol v7 is an IETF standard:
RFC 9171, with BPSec security (RFC 9172), default security contexts (RFC 9173), and the TCP convergence layer (RFC 9174), updated by RFC 9713 (2025); BPv6 was RFC 5050 and the architecture RFC 4838. It runs operationally on the International Space Station (the DTNME engine), first flew in space on UK-DMC in 2008, was demonstrated deep-space by NASA JPL's DINET (Deep Impact / EPOXI), and is used by NASA's PACE mission. This layer sits on top of that standard.
Is it production-ready?
It is a reference implementation, proven end to end on real infrastructure, not an audited production system. Review it and run your own assessment before relying on it. You hold your own keys and funds; nothing here custodies keys or broadcasts on your behalf.
How do I try it?
Clone the repo and run the proofs (see
Quickstart).
npm test and
npm run demo need only Node;
make spike,
make r2, and
make live exercise the real netem, real BPv7, and real on-chain paths.
