Baus is a crypto and AI early-stage liquid fund. We back exceptional founders already in motion.

We have a liquid position in Darkwoods and $DARK. The company is early. The public GitHub organization is empty. No founder names are on the work. The product is already live: a private AI lab on Robinhood Chain, a wallet as the account, USDG as credit, models that the docs say run in hardware enclaves. If the loop is real, this is infrastructure for inference that cannot leak. That is the shape of the bet—not a promise.

A private lab, wallet-native

Darkwoods (darkwoods.ai, @darkwoodslabs) states the product in one line: “Ask anything. The woods remember nothing.”

There is no email. There is no password. A wallet is the account. The app at app.darkwoods.ai is a chat: pick an open-weight model, stream an answer, keep history in the browser. Developers get an OpenAI-compatible API at `https://api.darkwoods.ai/v1`. Same models. Same credits. Their docs list uncensored variants where they exist, custom agent tools, and an image and video studio in the app. The public GitHub organization (darkwoodsai) has no public repositories as of this writing.

The agent surface is opt-in. With tools on, the model can search the web, fetch a page, do arithmetic, read the clock, or read public balances on Robinhood Chain and the wallet’s own credit balance. Those calls run on Darkwoods servers. The docs say a web search goes out as Darkwoods, not as you. Nothing in that mode signs, sends, or executes a transaction. The studio is a second surface: image and video generation with a privacy label on the model. We will not invent modes beyond what the product exposes.

The thesis is not another chat wrapper. It is private inference as a surface: open-weight models, no account, a credit that moves on-chain, and a claim that the words do not persist.

The crypto loop

Credits are USDG on Robinhood Chain. The docs are explicit: 1 USDG is 1 credit. A purchase is one transaction to a CreditPurchase contract. Minimum 5 USDG. Credits belong to the wallet that bought them—no transfer, no withdrawal, no refund.

Each purchase is split on-chain the moment it lands. The public contracts name three destinations: DarkStaking, which pays $DARK stakers a share in USDG; a buyback wallet; and a treasury that pays for inference. DarkStaking has no owner, no pause, and no upgrade. The CreditPurchase owner can change the split. That is the loop we can describe from the docs without inventing volume.

If builders and agents keep buying credits to run private inference, USDG flows through a public split into staking rewards, buybacks, and compute. If they do not, the token is a weather report. We care about whether credits move because someone is shipping. Early social posts about credits sold or tokens burned are not an audit. We will not anchor a thesis on them.

What “remember nothing” actually means

The marketing line is absolute. The docs are not, and that is the honest version.

Darkwoods’ docs claim prompts and answers pass through memory only—written to neither a log, a database, an error tracker, nor a cache—and that every model served today runs inside an Intel TDX enclave at the inference gateway, with an attestation report one unauthenticated request away. Conversations live in the browser; optional sync is ciphertext under a key derived from the wallet. No content moderation. Requests are checked for shape, never meaning.

They also keep what a private lab has to keep. The wallet address is the account. The credit ledger is permanent. Request metadata—model, token counts, cost, latency, never the text—is kept about 30 days, then folded into daily totals, and deleted at once if history is off. Operational logs are kept about seven days: request id, route, status, duration, Cloudflare ray id. A wallet address is never logged. Cloudflare terminates TLS at the edge. Fly hosts the origin. Both can see traffic in transit, as they can for most of the web.

That is not “nothing.” It is a narrower surface than a hosted chat with an account, a transcript, and a training clause. The claim is only as strong as the enclave, the attestation, and the code path. Those have to be checked, not believed.

Sizing the loop

We will not invent Darkwoods revenue, users, TVL, or credit volume. Public market-size reports give adjacent pools. They do not give this company a line. What follows are illustrative paths—bear, base, bull—for a share of those pools. They are not predictions. Not token-price targets. Not AUM.

The closest infrastructure pool is confidential-computing software: the AI-enabling layer, not the whole hardware stack. Mordor Intelligence has that software market near $3.25 billion in 2025 and about $3.91 billion in 2026. Future Market Insights has a broader confidential-computing market near $8.9 billion in 2025. Fortune Business Insights, a wide definition, has the category near $24 billion in 2025 and about $43 billion in 2026; we treat that as upper context only. Definitions vary. As a mid-range for the software / AI-enabling layer, we use about $4 billion.

The closest routed-inference proxy is the privacy-sensitive share of foundation-model API spend. Menlo Ventures’ 2025 report, The State of Generative AI in the Enterprise, puts U.S. enterprise foundation-model APIs at $12.5 billion. Not all of that needs an enclave. The slice that cannot leak a prompt is the one Darkwoods is built for.

Illustrative annual credit GMV—USDG spent through the lab—against that ~$4 billion software mid-range, with the privacy-sensitive share of API spend as the second pool:

  • Bear (~0% of either pool): a niche wallet-native tool. Weak or unproven enclave claims. Near-zero durable GMV.
  • Base (~0.5–1.5% of the ~$4 billion software mid-range): about $20–60 million GMV. Meaningful crypto-native and privacy-seeking builder spend through USDG credits. A real lab, not a landing page.
  • Bull (~5–10% of the software layer, plus a share of privacy-sensitive API routing): about $0.2–0.4 billion on the software pool alone, and more if Darkwoods becomes the default private, open-weight inference surface for agents that cannot leak prompts.

What must be true: credits move because someone is inferring, not because a chart is green. Attestation is checkable. The on-chain split stays a function of real purchases. If that fails, the bear case is the honest one. A liquid fund does not underwrite a slide that says TAM. It underwrites whether a loop can take a share of a spend pool that is already large—and whether that share is usage.

Risks

The failure modes are not subtle.

  • The privacy model is a claim until attestation is independently verified and the code path is independently reviewed. Cloudflare and Fly sit on the TLS path. A wallet, a ledger, and request metadata persist. “Remember nothing” is a tagline.
  • The loop is purchase-funded. If USDG credit demand is speculative, staking rewards and buybacks are a weather report. Credits do not transfer or refund.
  • Robinhood Chain is early. The public GitHub organization is empty. The team is unnamed. Wallet-native, chain-native products die in empty rooms.

A liquid fund can sit with that uncertainty. It cannot sit with invented numbers.

Why this is a Baus position

Private inference is a missing layer. Agents that handle keys, medical text, deal rooms, or proprietary code cannot casually paste into a frontier lab. Open-weight models exist. Confidential computing exists. A wallet-native credit that settles like a good, on a chain where USDG is native, is the crypto-native version of that stack.

This sits next to the rest of the book. Orbio is a market for inference. Darkwoods is a private room in which inference can happen. One answers how intelligence gets paid for. The other answers whether the prompt can leave the room. Both are early. Both are liquid. Both fail if usage is theater.

If Darkwoods becomes the default surface for that work, it looks like infrastructure. Infrastructure that works can be a 100x. That is the early-stage liquid job.

If you are building private inference, confidential agents, or crypto rails under AI work that cannot leak—send the sharpest version of the loop. The edge. What you have made real. What you need next.

hello@baus.ai