Dragonfly Asset Management

Targon: The Swiss Bank of Decentralised AI

The missing privacy layer that unlocks enterprise AI

Subnet 4 · Bittensor Network
Investment Report · May 2026

Important Information

This document has been prepared by Dragonfly Asset Management Ltd, authorised and regulated by the Financial Conduct Authority. It is intended solely for professional investors and eligible counterparties within the meaning of MiFID II, and is not suitable for, or directed at, retail clients. The information contained herein does not constitute investment advice, a recommendation, or an offer or solicitation to buy or sell any financial instrument.

Digital assets are speculative and highly volatile. Past performance is not indicative of future results. Investors may lose the entirety of their investment. The opinions expressed reflect the views of Dragonfly as at the date of publication and are subject to change without notice. Market capitalisations, token prices, and network statistics cited in this report are drawn from third-party sources believed reliable but not independently verified, and are accurate as at early May 2026.

Dragonfly and its affiliates may hold positions in the digital assets referenced in this report. Recipients should seek independent financial, legal, and tax advice before making any investment decision.

Executive Summary

A "Swiss Bank" Style Vault for the Age of Intelligence

Confidential by Design

In the early nineteenth century, Switzerland built a banking system on a single structural promise: that capital could be deposited under hardware-enforced confidentiality so absolute that not even the bank itself could see it. Numbered accounts were not a marketing flourish. They were the architectural innovation that unlocked an entire category of capital that would not otherwise have crossed a border. Two hundred years later, the same promise is being engineered into computing infrastructure - and the deposits are no longer money, but data, models, and the proprietary intelligence on which the next economy will be built.

Bittensor - the decentralised AI network now openly endorsed by NVIDIA's Jensen Huang and discussed by Chamath Palihapitiya on the All-In Podcast - has emerged in the past eighteen months as the most credible challenger to the centralised AI duopoly, which trade at incredible "monopoly forever" valuations. If Alphabet is the holding company for Google's many AI bets, Bittensor is the decentralised equivalent. It now hosts more than 120 subnets - individual specialist AI models, each competing within its own niche - generated approximately $43 million in AI usage revenue in Q1 2026 alone, and is expanding from 128 to 256 subnet slots. Yet for all its momentum, Bittensor faced a structural problem that no amount of token incentive design could solve: enterprises with sensitive workloads - healthcare, finance, defence, regulated AI applications - were very reluctant to run them on a permissionless network of anonymous miners. The whole appeal of decentralised compute, that anyone could contribute hardware, was also its commercial ceiling.

Targon (Subnet 4) may be the answer. Think of every other decentralised AI network as a shared workspace: cheap, flexible, but with no walls between the people working there. A bank cannot run its loan models in a shared workspace. Nor can a hospital run its diagnostic AI, nor a defence contractor its image analysis. Targon, built by Manifold Labs and validated through a co-authored whitepaper with Intel engineers, is the equivalent of a private, sealed office inside that workspace - one where the building's owner cannot see in, cannot listen, and cannot copy what is happening on the desk. The technology behind this is the Targon Virtual Machine, which uses a combination of Intel and NVIDIA's most advanced confidential computing chips to ensure the host machine literally cannot see what is running on it. The hardware itself proves, every seventy-two minutes, that the workload remains intact and undisturbed. It is the first decentralised AI subnet that an enterprise compliance officer can plausibly approve.

The Investment Thesis in Brief

Confidential AI compute is one of the largest commercial opportunities in technology today, with addressable demand spanning healthcare, financial services, defence, pharmaceuticals, government, and any enterprise that handles regulated or proprietary data. The hyperscalers have monetised the public cloud at hundreds of billions of dollars in annual revenue precisely because trust, security, and compliance have always been the gatekeepers to enterprise AI workloads. Targon is the first decentralised network engineered to clear that bar - and is doing so today, with paying customers, at a fraction of the cost.

Targon currently trades at a market capitalisation of approximately $72 million against management-projected annualised run-rate revenue of $10 million-plus from paid GPU rentals - a revenue multiple that would be considered remarkable for a Series A software business in any other corner of capital markets. By comparison, the broader Bittensor subnet ecosystem now trades at a combined $1.5 billion, and Targon's nearest non-confidential competitor, Chutes (SN64), trades at a higher market cap with no confidential compute moat.

Targon has raised a $10.5 million Series A, secured an enterprise vision AI partnership with PwC France/Maghreb, joined NVIDIA's Inception programme, and powers Dippy AI - a consumer application with approximately 8 million monthly users. It currently runs across more than 1,500 H200-class GPU nodes, processing billions of inference tokens daily. This is no longer a thesis on technical promise. This is a thesis on a working product with verified external revenue, sitting inside the only decentralised AI ecosystem with institutional momentum behind it.

~$72M
Market Cap
$10M+
Projected ARR
1,500+
H200 GPU Nodes
$10.5M
Series A Raised

The pages that follow set out why this matters, how the technology actually works, who is already using it, and why Targon represents an attractive asymmetric investment opportunity as a decentralised AI infrastructure provider.

Section One

Why Decentralised Compute Stalled at the Enterprise Door

Every era of computing has faced the same recurring tension between openness and trust. The earliest mainframes were closed, controlled, and secure precisely because no one outside the organisation could touch them. Then came client-server, then the public internet, then cloud computing - and each transition unlocked enormous economic value by lowering trust barriers. Amazon Web Services did not invent the server; it invented a business model in which a third party could be trusted with your data. That trust was operational, contractual, and ultimately legal: AWS could see your data if it wanted to, but its commercial existence depended on not doing so.

Decentralised compute networks have always struggled to clear this same trust hurdle. The proposition is structurally appealing - turn the world's idle GPUs into a permissionless cloud, undercut the hyperscalers on price by an order of magnitude, and pay providers in protocol-native tokens. But the moment a serious enterprise customer asks the obvious question - "who owns the machine my workload is actually running on?" - the proposition collapses. The answer, until very recently, was: an anonymous miner in a country you have never heard of, who has root access to the host operating system. For a healthcare provider running diagnostic models on patient data, or a hedge fund running proprietary alpha-generating models, that is a complete non-starter.

This is why decentralised compute, despite years of marketing energy, has never meaningfully challenged AWS, Google Cloud, or Microsoft Azure for sensitive workloads. The hyperscalers have been able to defend the most valuable segment of the cloud market - regulated, compliance-heavy, enterprise-grade compute - not on price, not on performance, but on the simple question of who is allowed to look inside the machine.

The Swiss banking precedent

The historical parallel is striking. Before the formalisation of Swiss banking secrecy in 1934, capital flows across European borders were limited not by the cost of moving money but by the trust required to deposit it. A merchant in Lyon could not safely place funds in a Geneva bank if there was a possibility - however remote - that those funds could be inspected by the bank's owners or surrendered to a foreign government. The structural innovation was not just legal; it was operational. Numbered accounts meant that the people physically handling the deposits could not match them to their owners. The bank itself was prevented from violating the depositor's privacy. That single architectural decision unlocked decades of capital inflows, transformed Switzerland's economy, and made Zurich one of the most important financial centres in the world.

The structural problem in decentralised compute is identical. Sensitive AI workloads will not migrate from centralised clouds onto a permissionless network until that network can prove - not promise but cryptographically prove - that the host operator cannot inspect what is running on the machine. Operational secrecy will not suffice. Contractual secrecy will not suffice. Only hardware-enforced secrecy, verified at every block of the network, can close the gap. This is the precise problem that Targon has been engineered to solve.

"Even if they had a direct memory access device or any device like that, they wouldn't be able to actually get into the virtual machine. All of the data that you're actually using inside of the virtual machine is completely encrypted."

— Robert Myers, Co-founder, Manifold Labs (Targon)

Section Two

The Architecture of the Targon Vault

Targon is, on the surface, a marketplace for GPU compute. Miners contribute hardware - anything from consumer RTX 4090 cards to NVIDIA H200 enterprise GPUs - and customers rent that compute on demand to run AI workloads. In its raw economic form, this is a familiar pattern, indistinguishable from any number of decentralised compute projects launched over the past five years. What sets Targon apart is what happens inside the rented machine. Every workload runs inside a Targon Virtual Machine: a confidential virtual machine engineered so that the host operator - the person physically running the hardware - cannot see, touch, or inspect what is happening on their own GPU.

The architecture combines two recent breakthroughs in chip design. The first is a confidential computing feature on Intel's latest server processors that creates a fully encrypted "sealed room" inside the chip's memory - a region of the computer that is invisible even to the machine's own operating system. The second is a comparable feature on NVIDIA's high-end H100 and H200 GPUs, which encrypts the connection between the processor and the GPU itself so that nothing flowing between them can be intercepted. Targon stitches these two sealed rooms together and adds a continuous integrity check, so that the workload can prove every seventy-two minutes that nothing has been tampered with. AMD chips with similar capabilities provide a parallel option, broadening the pool of hardware that can participate.

The result is a system in which the operator of the physical machine is treated as a fundamentally untrusted party. The hardware itself enforces confidentiality. The network enforces continuity. Any deviation from the expected secure state takes the node offline immediately. For sensitive workloads, this is the difference between renting a server and renting a sealed, audited vault - and the parallel to numbered Swiss accounts is direct rather than metaphorical.

Figure 1 · The Targon Confidential Compute Stack
UNTRUSTED HOST · Miner-controlled hardware INTEL TDX TRUST DOMAIN · Encrypted memory enclave TARGON VIRTUAL MACHINE AI Workload Model · Data · Weights Inference / Training / Fine-tune NVIDIA GPU Protected PCIe Mode Encrypted GPU memory ENCRYPTED Encrypted Virtual Disk · Key held by Intel Key Broker Service Released only after successful remote attestation Continuous attestation to Intel Trust Authority — every 72 minutes
The host operator can see the box exists, but not what runs inside it. Hardware-level encryption replaces operational trust with cryptographic certainty.

The economics are equally compelling. A Targon H200 GPU - the enterprise workhorse used for serious model training and large-scale inference - rents for $2.40 per hour. The same H200 from a hyperscaler typically retails between $8 and $12 per hour, with additional charges for data transfer, storage, and dedicated networking that can double the effective rate. A consumer-grade RTX 4090 on Targon, the kind of card that powers high-end gaming PCs and is well suited to lighter inference, fine-tuning, and graphics workloads, costs $0.45 per hour - pricing that simply does not exist in the hyperscaler ecosystem because no hyperscaler runs consumer GPUs. For inference-heavy workloads, where the cost of compute compounds rapidly with usage, the differential is structural rather than promotional.

Section Three

Anatomy of a Sealed Workload

The provisioning flow - the sequence of steps a customer's AI workload goes through from the moment it is sent to a miner's machine to the moment it begins producing results - is worth understanding in detail. It is in these operational mechanics that the difference between Targon and every other decentralised compute network becomes apparent. The five-step process below is, in essence, the entire moat. Every other decentralised compute project that has tried to attack the enterprise market has stumbled at one or more of these stages. Targon is the first to have closed every gap.

Figure 2 · The Five-Step Provisioning Flow
1 Hardware Miner enables TDX in BIOS 2 Provisioning Image Gateway creates fresh VM 3 Attestation VM proves itself to Intel Trust 4 Continuous Re-attest every 72 minutes 5 Workload Runs end-to-end encrypted THE CRITICAL MOMENT IS STEP 3 The disk encryption key never resides on the miner's hardware. It is held by Intel's Key Broker Service and only released into the protected enclave after the VM cryptographically proves its boot state, kernel integrity, and software stack match the expected secure baseline. If anything fails, the workload never starts.
This is the same defence-in-depth model that banks and regulated cloud providers use for their most sensitive systems - hardware attestation, key escrow, and continuous integrity checks. The novelty here is doing it on a network of miners none of whom can be vetted in advance.

The watchdog that never blinks

The continuous attestation is the feature that converts Targon from a clever academic exercise into a production-grade enterprise platform. A one-time integrity check at startup is what every other confidential compute project offers. It is also what every adversary tries to defeat - by establishing a trusted state, then quietly modifying it once the watchdog has stopped looking. Targon's architecture rules this out by design. Every seventy-two minutes - the natural rhythm of a Bittensor block period - the VM is challenged with a fresh cryptographic nonce, must re-prove its full secure state, and is bound to its original IP address and hardware fingerprint to prevent migration or cloning. The system assumes the worst about every miner, all the time.

The March 2026 whitepaper, co-authored by Manifold Labs and Intel engineers and titled "Decentralised Compute on Untrusted Hardware Using Intel TDX and Encrypted CVMs," is the formal validation of this architecture. Two Intel engineers signed onto the paper as authors. This is not a marketing partnership. It is a technical endorsement from the world's most established hardware security vendor that the Targon design is sound, scalable, and production-ready. Few decentralised projects of any vintage have secured this kind of formal co-signature from a Tier 1 chip manufacturer.

"Bittensor is what OpenAI should have been. What OpenAI pretends to be."

— James, Manifold Labs / Targon

Section Four

From Whitepaper to Paying Customers

Crypto investing rewards the ability to distinguish a working business from a promising narrative. Targon is one of the few subnets in the entire Bittensor ecosystem where the distinction is now decisively in favour of the former. The signals are stacking up at a pace that, twelve months ago, would have seemed implausible for any decentralised AI project - let alone one operating on a permissionless network.

The most consequential of these is Dippy AI, a consumer companion application with approximately 8 million monthly users that runs the bulk of its inference workload on Targon's confidential compute. Dippy is not a partnership announcement on a press release; it is a paying customer generating real, recurring usage at production scale. The platform now processes approximately twenty billion inference tokens per day across more than 1,500 NVIDIA H200 GPU nodes - a throughput that places Targon firmly within the same operational tier as mid-sized centralised inference providers. Management's projection of $10 million-plus in annualised run-rate revenue is anchored in this kind of consumer volume rather than speculative pipeline.

The enterprise side is moving as well. In early 2026, Targon and Intel jointly secured a Vision AI deployment with PwC France and PwC Maghreb - the first publicly disclosed Big Four engagement to use a Bittensor subnet for confidential compute. The implications are larger than the contract itself. Big Four firms are exceptionally conservative about technology procurement and exceptionally rigorous about compliance review. A PwC sign-off on Targon's architecture is, in effect, a pre-built reference customer for every other regulated enterprise considering the same migration. Manifold Labs has also been admitted into NVIDIA's Inception programme, the company's vetted partner ecosystem, providing credibility, technical resources, and access to the broader NVIDIA enterprise sales motion.

Capital markets validation has followed. Manifold Labs raised a $10.5 million Series A in early 2026, a meaningful round for a team building infrastructure rather than consumer applications, and one that suggests sophisticated venture investors view the technology as durable rather than narrative-driven. The funding extends Manifold's runway, accelerates hardware onboarding, and - perhaps most importantly - provides the institutional ballast that enterprise customers expect to see on a vendor balance sheet before signing multi-year contracts.

Figure 3 · Targon Operational Footprint, May 2026
Daily inference throughput compared with peer subnets Inference tokens per day (billions) 100B 75B 50B 25B 0 ~20B Targon (SN4) Confidential ~80B Chutes (SN64) Volume play Training Templar (SN3) Pre-training Targon is the only major throughput subnet with confidential compute
Chutes leads on raw volume; Templar leads on training breakthroughs; Targon is the only top-tier compute subnet that can serve sensitive enterprise workloads. The three are complements, not substitutes.

Public attention has followed. On 20 March 2026, NVIDIA's Jensen Huang and Chamath Palihapitiya openly endorsed Bittensor on the All-In Podcast, framing decentralised AI training as a credible complement to proprietary models. Coming from the CEO whose company sells the chips that power both centralised and decentralised AI, the endorsement carried weight beyond the usual Crypto echo chamber. Within days, Bittensor's wider ecosystem rallied; Targon's own token gained 166% in the month that followed. None of this is conventional Crypto hype: it is the sign of an emerging business that is beginning to be seen, named, and validated by the audiences that ultimately move institutional capital.

Section Five

Not a Competitor. A Layer.

Investors new to Bittensor often assume that the leading subnets must be in direct competition with one another, the way two e-commerce platforms or two cloud providers might fight over the same customers. The reality is closer to the structure of a modern technology stack, in which different layers play different roles and the most successful businesses are those that occupy a defensible position in one specific layer. Templar (Subnet 3) trains models. Chutes (Subnet 64) serves high-volume general-purpose inference. Targon (Subnet 4) provides the confidential compute layer that no other subnet offers. Each is a leader in its own niche, and the three together represent the operational backbone of what is, on a daily basis, a $43 million-per-quarter AI revenue ecosystem.

Targon · SN4
Chutes · SN64
Templar · SN3
Primary Focus
Confidential GPU compute
Serverless inference
Decentralised training
Built By
Manifold Labs
Rayon Labs
Templar team
Market Cap
~$72M
~$130M+
~$130M+ (peak)
Differentiator
Hardware encryption
Volume & cost
Training breakthroughs
Daily Throughput
~20B tokens
~80B+ tokens
Training runs
External Validation
Intel · NVIDIA · PwC
OpenRouter #1
NVIDIA · arXiv paper
Target Customer
Enterprise · Regulated
Developers · Apps
AI researchers

What this comparison reveals is that Targon trades at a meaningful discount even to its subnet peers despite having structural advantages that none of them possess. Chutes and Templar are excellent businesses in their respective niches, but neither has hardware-enforced confidentiality. Neither has signed a Big Four enterprise engagement. Neither has co-authored a whitepaper with Intel. Neither has raised a venture round at scale. We have often highlighted how extraordinary the discounts are between subnet valuations and their large centralised competitors; in Targon's case, there is a meaningful discount to other comparable subnets too. In our view, the market has not yet fully priced in the difference between subnets that can credibly migrate enterprise workloads from AWS and those that cannot. We believe this gap is unlikely to persist as the next wave of institutional capital, supported by the pending Grayscale TAO ETF and the broader Bittensor narrative, begins to seek positioning within the ecosystem.

The valuation gap extends well beyond Bittensor itself. In the next section we set out exactly how Targon compares to the wider universe of decentralised infrastructure tokens - and why we believe the asymmetry on offer here is genuinely compelling.

Section Six

The Asymmetric Setup: Priced Below Every Comparator

At the time of writing, Targon's circulating market capitalisation sits at approximately $72 million. Against management's projected annualised run-rate revenue of $10 million-plus, this implies a price-to-revenue multiple of roughly seven times. For a working enterprise infrastructure business with strategic Tier 1 hardware partnerships, growing usage, and a defensible technology moat, this is a multiple that simply does not exist in private markets. A comparable stage software business operating in a similar fast-growing, huge-TAM sector with the same revenue profile and same calibre of customer base would price closer to forty or fifty times.

Figure 4 · Targon vs Decentralised Infrastructure Comparators
Market capitalisation, USD millions, May 2026 $1,000M $750M $500M $250M $0 $72M Targon SN4 $130M Chutes SN64 $220M Akash Compute $650M Filecoin Storage ~$1,000M Render GPU rendering Targon: working revenue, enterprise customers, hardware moat
Targon trades below every comparable decentralised infrastructure asset, despite generating verifiable external revenue and operating the only confidential compute layer in the category.

Taking every Crypto peer-set comparator, the magnitude of the upside potential for Targon is clear. Render Network, a decentralised GPU rendering project with no confidential compute, has at various points traded above $1 billion in market capitalisation. Filecoin, a decentralised storage protocol with no confidential compute and arguably weaker enterprise traction, sits at approximately $650 million. Akash Network, perhaps the closest like-for-like comparator on the decentralised compute axis but without hardware-enforced privacy, trades around $220 million. Within Bittensor itself, Chutes and Templar both command higher market caps than Targon, despite operating in segments without enterprise-grade confidentiality requirements.

Reasonable people will disagree about exactly how to weight these comparators, and Dragonfly is not in the business of issuing price targets. But the pattern is clear enough to articulate without overreach: Targon today is priced as if its enterprise opportunity, whitepaper-validated technology moat, and growing revenue base will not materialise. The risk-reward calculus changes meaningfully in a scenario where any one of these - let alone all three - continues on its current trajectory.

"There's so much fundamentally sound building happening on Bittensor that the price has no option but to catch up."

— Rob Greer, General Partner, Stillcore Capital

Section Seven

The Tide Behind the Trade

The investment case for Targon does not rest on any single catalyst, which is itself a useful diversification of risk. What is striking is the pattern: a sequence of independent developments, each modest in isolation, each pointing in the same direction, and each compounding the credibility of the underlying thesis. The next twelve months are likely to be busier than the last, and the same is broadly true for the wider Bittensor ecosystem of which Targon is a load-bearing component.

Bittensor itself is in a structurally different position from a year ago. The network generated approximately $43 million in AI usage revenue in Q1 2026 - a number large enough that it begins to compare favourably with mid-tier traditional software businesses. The Robin τ protocol upgrade, scheduled for full implementation through 2026, doubles subnet capacity from 128 to 256 slots, expanding the addressable surface for new AI applications and providing organic growth tailwinds for incumbents like Targon that are likely to absorb additional workload as the ecosystem scales. The December 2025 halving - which cut daily TAO emissions from 7,200 to 3,600 tokens - has tightened supply against rising fundamental usage, replicating the structural setup that has historically marked the early phase of meaningful Bitcoin cycles. For Targon specifically, a healthier and better-capitalised Bittensor ecosystem translates directly into stronger enterprise credibility, deeper liquidity in its own token, and a more attractive backdrop against which to onboard institutional customers.

Institutional access is opening as well. Grayscale's GTAO Trust began trading on the NYSE in January 2026, and the firm's S-1 filing to convert the trust into a spot ETF is now under SEC review, with a decision anticipated by late 2026. Approval would replicate, on a smaller scale, the institutional demand impact that the Bitcoin and Ethereum ETFs have already demonstrated. Yuma - the Bittensor-focused subsidiary of Digital Currency Group - is now an active participant in fourteen separate subnets, providing both validation and meaningful staking demand. Yuma is led by Barry Silbert, founder and CEO of DCG, who built the firm into one of the most influential incubators in digital assets - launching Grayscale, Foundry, and CoinDesk along the way - and has stepped back into a hands-on CEO role for the first time in four years specifically to lead Yuma's expansion into decentralised AI. In October 2025, he launched Yuma Asset Management with a $10 million seed from DCG, explicitly to give institutional investors a structured route into Bittensor and its subnet tokens.

Alongside Yuma, a new dedicated subnet fund has emerged with serious credentials: Stillcore Capital, launched in September 2025 by Mark Jeffrey and Rob Greer, with legendary Silicon Valley angel investor Jason Calacanis as consulting partner. Calacanis is best known as one of Uber's earliest backers - a small angel cheque that famously grew into a stake worth tens of millions - and as the host of This Week in Startups and co-host of the All-In Podcast. Stillcore's stated goal is to acquire approximately 1% of TAO's circulating supply and invest selectively in subnet alpha tokens. Polychain Capital and other top-tier Crypto venture firms have publicly disclosed Bittensor positions. Taken together, these dedicated subnet vehicles - run by seasoned technology investors with deep institutional relationships - are exactly the kind of capital that closes valuation gaps in attractive subnets. We expect their influence on prices to grow steadily through 2026.

Targon-specific catalysts

For Targon specifically, the next set of inflection points is well-defined. The team's roadmap includes the broader rollout of TargonOS, which extends confidential computing capabilities to consumer-grade NVIDIA GPUs and substantially widens the supply side of the marketplace. The PwC France/Maghreb Vision AI deployment is expected to publish case-study material that, if positioned well, could anchor the enterprise sales motion through the rest of 2026 and 2027. The Manifold team has indicated active conversations with additional Big Four firms and several regulated financial institutions. Each new enterprise reference customer compounds the credibility of the next, in the way that early AWS reference customers compounded into the durable enterprise migration that ultimately built the modern cloud.

The market backdrop is also moving in Targon's favour at the macro and narrative level. The conversation around AI has shifted, in the past six months, from "will the technology work" to "who will own it" and most pressingly "can the current business models be funded and become economically viable." Centralised AI is increasingly under regulatory pressure in the European Union and politically contested in the United States. Decentralised, privacy-preserving alternatives - once the preserve of Crypto-native developers - are now a topic of mainstream policy debate. Targon sits precisely at the intersection of these trends: a decentralised AI layer with privacy guarantees that hyperscalers structurally cannot match.

"The mass production of cheap intelligence makes it wide and abundant for everyone. It kneecaps the monopolies that an Anthropic or OpenAI might have right now."

— Rob Greer, General Partner, Stillcore Capital

Section Eight

What Could Go Wrong

Targon, in common with every digital asset, carries substantial risks that must be priced into any allocation decision. Dragonfly's position sizing in any single subnet, including Targon, reflects this directly: we size positions so that adverse outcomes in any one holding remain comfortably within the overall risk budget of the portfolio, and we monitor concentration, liquidity, and correlation across the basket continuously. The four risks that we consider material for Targon specifically are set out below.

Token volatility and emission overhang. Targon's Alpha token (SN4) has at points traded as low as $5.99 and as high as $39.23 within the past twelve months. Daily price moves of fifteen to twenty per cent are not unusual. Beyond pure volatility, the broader Bittensor subnet ecosystem faces a structural reality in which protocol-level emissions to subnets currently exceed external revenue across most of the network - Targon included, on a strict cash-versus-emission basis. The bull case requires that real revenue continues to grow toward, and ultimately past, the emissions subsidy. The bear case is that emissions continue to inflate the float without proportionate revenue growth, eroding token value over time. We believe Targon is among the better-positioned subnets on this dimension given its enterprise revenue mix, but it is not immune to the pattern.

Bittensor ecosystem dependence. Targon is a Bittensor subnet, not an independent protocol. Any meaningful deterioration in the credibility, stability, or institutional reception of Bittensor itself flows directly into Targon's valuation. The architectural elegance of the dTAO model - in which the success of any subnet drives demand for TAO and therefore benefits all participants - works in reverse in stress scenarios. A serious technical failure, a high-profile subnet collapse, or an adverse regulatory development at the network level would affect Targon regardless of its own operational performance. Naturally, we monitor Bittensor governance and Opentensor Foundation activity closely.

Competition from non-confidential compute subnets. Chutes (SN64) is a serious competitor for general-purpose inference workloads, with greater raw throughput and a more developer-friendly onboarding experience. Targon's confidential compute moat is structurally deep for sensitive enterprise workloads, but a meaningful share of inference demand - perhaps the majority - does not require hardware-enforced privacy. If Chutes or another peer were to add credible confidential compute capabilities, the moat would narrow. Trusted Execution Environment technology is becoming more accessible, and Targon's first-mover advantage is reinforced rather than guaranteed by the Intel partnership and TVM architecture.

Hardware partner concentration. Targon's confidential compute architecture currently relies heavily on Intel TDX for CPU-side encryption and NVIDIA's Protected PCIe for GPU-side encryption. AMD SEV provides an alternative path, and the team is actively broadening hardware support, but a serious vulnerability in either Intel TDX or NVIDIA Confidential Computing - whether disclosed publicly or exploited adversarially - would create immediate operational and reputational risk. This is a known characteristic of all confidential computing architectures, not a Targon-specific weakness, but it should be priced in.

Beyond these specifics, the standard caveats apply. Digital assets remain a regulatorily unsettled category in most jurisdictions. Token holders do not own equity in Manifold Labs or any other operating entity. Liquidity in Alpha tokens, while improving, remains thinner than in major cryptocurrencies and can deteriorate sharply during periods of market stress.

Section Nine

The Dragonfly USP: "A Liquid VC Fund"

Dragonfly's investment philosophy in decentralised AI is not to identify a single winner. The honest reality of investing this early in any technology shift is that the eventual leaders are not yet guaranteed, and the projects that look strongest today are not always the projects that compound through to maturity. Our approach has therefore been to build risk-controlled, diversified exposure across the most credible decentralised AI primitives - confidential compute, decentralised inference, decentralised training, decentralised storage - with the discipline to reallocate as the picture clarifies.

The luxury of investing in liquid token markets is that we do not need to commit irreversibly. If a better confidential compute solution emerges within Bittensor or elsewhere, we can rotate. If Targon executes against the current trajectory, we can scale into the position. This is fundamentally different from venture-style investing, where capital is locked into a single bet for years at a time, and where the wrong horse cannot easily be unwound. We believe decentralised AI is one of the most attractive thematic investment opportunities available in any asset class today, and we believe that thesis is best expressed through a basket of liquid positions rather than a concentrated bet on a single protocol.

Targon, in our view, is one of the strongest individual constituents of that basket. It combines a defensible technology moat, growing external revenue, Tier 1 hardware partnerships, institutional venture backing, and exposure to the most credible decentralised AI ecosystem in the market - all at a valuation that sits below comparable peers. The asymmetric profile is what attracts us: limited downside relative to the realistic floor of the asset's intrinsic value, meaningful upside if the enterprise and ecosystem trajectories continue to compound. We hold the position. We will continue to monitor it. And we will adjust our weight as the evidence demands.

· · ·
CONFIDENTIAL · DECENTRALISED · INTELLIGENCE
Dragonfly Asset Management · May 2026