Arcium Blackthorn supply gap: 600 to 4,500 rentable confidential GPUs worldwide
Quote396 words
Arcium's survey of about 80 providers, cited in Four Pillars' Blackthorn deep dive, counts only 600 to 4,500 rentable confidential GPUs, about 0.04% of capable NVIDIA chips. Blackthorn drops the host enclave and binds the GPU to the live key exchange; Charité Berlin is reportedly its first production partner.
Key claims
Only 600 to 4,500 confidential GPUs are rentable today, about 0.04% of NVIDIA chips that support confidential computing
Blackthorn removes the Intel or AMD host enclave, so bare-metal Hopper and Blackwell fleets go confidential with a software install
The GPU signs the live key exchange, closing the CPU-to-GPU binding gap Phala flagged in February
Whitepaper estimates about 7% overhead and 30 to 60 tokens/s on a 70B model on one H100
Charité Berlin is reportedly the first production partner, not yet announced by Arcium or Charité
Only 600 to 4,500 confidential GPUs can be rented anywhere in the world right now.
That's ~0.04% of the NVIDIA chips that support confidential computing. All the confidential AI compute you can actually buy adds up to roughly 2% of xAI's Colossus.
The numbers come from Arcium's survey of ~80 providers, in @FourPillarsFP's new Blackthorn deep dive. And they're the part of the thesis I undersold in my post below.
Why so few?
Today's stack needs an Intel or AMD enclave on the host to vouch for the GPU. CoreWeave, Lambda, Crusoe and Nebius all run the right NVIDIA chips, but none of them offer that host setup, so they can't sell confidential AI at all. Among hyperscalers, only Azure and Google Cloud sell it, one GPU per VM.
Blackthorn drops the host enclave. For those bare-metal Hopper and Blackwell fleets, going confidential becomes a software install instead of new hardware.
Second thing: the weak link I flagged runs deeper than "the Intel chip got broken".
NVIDIA's attestation only proves the GPU is genuine. Nothing ties it to the enclave checking it. Break the enclave, forge its side, pair it with a real report borrowed from someone else's GPU, and every check passes while your prompt runs in plaintext.
And that gap is real in production: @PhalaNetwork's own February security update said CPU-to-GPU binding wasn't enforced at the platform level.
Blackthorn closes it by having the GPU sign the live key exchange itself. A borrowed report carries the wrong exchange values and gets rejected on the spot.
On speed, the whitepaper estimates (still no public benchmark tho):
- ~7% overhead from NVIDIA's confidential mode, the MPC layer adds next to nothing on top
- 30 to 60 tokens/s on a 70B model, single stream on an H100
- 50 to 200 ms to open a session
Btw: Arcium's MPC protocol is built so one honest node is enough. But per Four Pillars, v1 runs it in honest-majority mode for speed, so for now most of the nodes have to be honest.
Third (and last) thing: per Four Pillars, Blackthorn's first production partner is Charité Berlin, already running it on data from 20,000+ heart and lung transplant patients, with a multi-hospital product as phase 2. Not announced by Arcium or Charité yet tho, so pending.
$ARX still at ~$45M mcap. Thesis remains unchanged.
NFA though ofc. DYOR.
QUOTING @zerokn0wledge_
Venice is a $1.3B bet that people will pay for private AI. What many don't talk about: its privacy still runs through an Intel chip, and that chip got broken twice in the last 12 months. @Arcium just shipped the version without that chip, at $49M mcap. Why does the chip matter? Venice's encrypted mode runs the model on NVIDIA GPUs with an Intel TDX enclave in front of them (per its own docs), which makes TDX the weak link. TEE(.)fail pulled attestation keys straight off the DDR5 bus in October 2025, and DDRop forged TDX attestation with a $159 interposer in September 2026. The NVIDIA side of things survived both, bc GPU memory sits inside the package where you can't clip a board onto it. Blackthorn is basically the same stack with the Intel part cut out, shipped as infra: an API, rented GPUs, or self-install on your own Hopper/Blackwell boxes. It's not a consumer-facing chat app in itself. On a more technical level: The model runs in plaintext inside confidential GPU memory, the session keys that unlock it get split across MPC nodes, and MPC never touches the per-token path. Arcium says near-native speed, no public benchmark yet tho. So what's it priced at? - $ARX: $49M mcap, $234M FDV - $VVV: $1.3B mcap, $2.2B FDV 27x on mcap, 9x on FDV, for the stack with one less party to trust. Which imo btw also means the obvious move for Arcium is sitting right there: a Venice-style front end on Arcium's own API once the infra is proven. Without that app layer, Venice isn't the cleanest comp yet tho. The more congruent ones are the TEE infra Venice actually runs on: @NEARProtocol's NEAR AI Cloud and @PhalaNetwork, both announced as Venice's confidential inference providers on the 19th of March 2026, both TEE-based, which is where the Intel TDX enclave from above lives. Also: NEAR is listed for completeness only tho, a $7B L1 where private AI is a rounding error isn’t a comp. Phala is. - $PHA: $50M mcap, $59M FDV - $NEAR: $7B, with private AI a rounding error inside an L1 So infra vs pure infra, $ARX already trades at a 4x FDV premium to Phala. A sign that the market doesn't price Blackthorn like cheap TEE infra. It's already starting to price it as a shot at the app layer. Which brings us back to Venice. The valuation gap there exists for a reason today. Blackthorn is still a gated alpha with no fees. Venice is a real product with users and revenue. But that's the whole point of buying the alpha instead of the product: you get the better trust model before the market prices it in. If Blackthorn (and a Venice-style product, in-house or not, built on it) attracts real users, this gap will close. And that's my bet. NFA ofc. DYOR.
Venice is a $1.3B bet that people will pay for private AI. What many don't talk about: its privacy still runs through an Intel chip, and that chip got broken twice in the last 12 months. @Arcium just shipped the version without that chip, at $49M mcap. Why does the chip matter? Venice's encrypted mode runs the model on NVIDIA GPUs with an Intel TDX enclave in front of them (per its own docs), which makes TDX the weak link. TEE(.)fail pulled attestation keys straight off the DDR5 bus in October 2025, and DDRop forged TDX attestation with a $159 interposer in September 2026. The NVIDIA side of things survived both, bc GPU memory sits inside the package where you can't clip a board onto it. Blackthorn is basically the same stack with the Intel part cut out, shipped as infra: an API, rented GPUs, or self-install on your own Hopper/Blackwell boxes. It's not a consumer-facing chat app in itself. On a more technical level: The model runs in plaintext inside confidential GPU memory, the session keys that unlock it get split across MPC nodes, and MPC never touches the per-token path. Arcium says near-native speed, no public benchmark yet tho. So what's it priced at? - $ARX: $49M mcap, $234M FDV - $VVV: $1.3B mcap, $2.2B FDV 27x on mcap, 9x on FDV, for the stack with one less party to trust. Which imo btw also means the obvious move for Arcium is sitting right there: a Venice-style front end on Arcium's own API once the infra is proven. Without that app layer, Venice isn't the cleanest comp yet tho. The more congruent ones are the TEE infra Venice actually runs on: @NEARProtocol's NEAR AI Cloud and @PhalaNetwork, both announced as Venice's confidential inference providers on the 19th of March 2026, both TEE-based, which is where the Intel TDX enclave from above lives. Also: NEAR is listed for completeness only tho, a $7B L1 where private AI is a rounding error isn’t a comp. Phala is. - $PHA: $50M mcap, $59M FDV - $NEAR: $7B, with private AI a rounding error inside an L1 So infra vs pure infra, $ARX already trades at a 4x FDV premium to Phala. A sign that the market doesn't price Blackthorn like cheap TEE infra. It's already starting to price it as a shot at the app layer. Which brings us back to Venice. The valuation gap there exists for a reason today. Blackthorn is still a gated alpha with no fees. Venice is a real product with users and revenue. But that's the whole point of buying the alpha instead of the product: you get the better trust model before the market prices it in. If Blackthorn (and a Venice-style product, in-house or not, built on it) attracts real users, this gap will close. And that's my bet. NFA ofc. DYOR.
1 image on X
How the call played out · since 23 Oct 2026
Prices as of 23 Oct 2026This piece takes a view on $ARX, so that move is read against the call.
0.0%
Moved with the call · over the same day
- At publication
- $0.213
- Now
- $0.213
- vs BTC
- 0.0%
Since then
No follow-up pieces on this subject yet. This is the latest take.
Daily closes in USD from DefiLlama and Yahoo Finance. Only a bullish or bearish thesis is read as a call; explainers, maps and mentions are context. Not financial advice.