Token2049 week is here and I'm speaking on 6 stages. The theme for me this year is clear. Tokenization has moved past pilots, and the real questions now are about risk, settlement, and distribution. That's where oracles and risk data matter most. Find our team and me on stage: 1. Token2049 main stage with Kristen (FTSE Head of DA), @vinhonchain and @annabelleacta 2. TokenizeThis Singapore, our own event. Institutions, issuers and allocators in one room 3. Agentic Summit. AI agents moving onchain capital need trusted data even more than people do 4. RWA Summit Singapore 5. The Capital Summit 6. HSC If you're building in RWAs, onchain credit, or institutional DeFi, let's talk. See you in Singapore this week!

We've wrapped up RedStone's team retreat in Poland. Four focused workshop sessions on institutional onchain finance expansion. We forced ourselves through the hard questions: what actually needs to happen in the next 12 months and 5 years so RedStone can enable scaling this market from $30 billion to the trillions everyone keeps citing. One insight kept surfacing across those sessions. RedStone sits at an intersection almost nobody else occupies: data, risk analysis, infrastructure and onchain settlement, all under one roof, all built for institutional finance, with the highest technical quality and reliability. That combination is rare. It's exactly what this next phase of the market needs. Our international team left appreciating Warsaw and Poland even more than they already did. Turns out you can run four packed workshop sessions with real, actionable output and still make room for team-building activities like basketball, kayaking down a river, or a bonfire. The next few months are going to be massive for RedStone and the industry.

.@AnthropicAI is the most valuable AI startup in the world. $965B post-money valuation. $9B to $47B in run rate in nine months. Here's how it got there, and how exposure to its perps already lives onchain.

That's a big one. @extendedapp has launched 100+ RWA and crypto markets on an RFQ model, targeting 1,000. RedStone Live is the data layer behind the real world markets. RWA perps did $937B in volume in Q2 2026, nearly double Q1. The demand is real and growing, and the bar for trusted pricing rises with it. The interesting part is how Extended got there. RFQ solves the long tail liquidity problem. On any given day traders want a handful of specific tickers out of hundreds. In a CLOB model that is economically infeasible. Market makers would need to park capital across hundreds of idle books waiting for someone to show up. Which shifts the constraint from capital to data. If you are quoting 1,000 markets on request, you need a defensible reference price for every one of them, at any hour, including the ones sitting quiet because their exchange is closed. Fragmented sources, off hours coverage, a methodology that reflects how these markets actually behave. That is what RedStone Live was built for. Perps will continue to grow and RedStone continues to power that growth.

Clarity Act week. A big one for tokenization. Trump signed off on the ethics provision earlier this week, the main issue that's blocked this bill for a year: capping how sitting officials can profit from crypto while in office. Bill text should be ready in the coming days. Senate vote before August recess. If it clears the Senate, it goes back to the House, then to the president's desk. Patrick Witt deferred his National Guard training to see this through. Here's why Clarity can be the real unlock. Tokenized RWAs are already at over $31B onchain, up 5x from $6B eighteen months ago. BCG puts the 2030 ceiling at $16 trillion. None of that scales without a federal framework institutions can actually underwrite against. That's part of the tokenization decade.

$23M left Ostium's vault yesterday and every price that made it happen was validly signed. That sentence should worry perp DEX builders more than any flash loan story of the past three years. Breakdown below. Ostium is a smart team that runs an RWA perp DEX on Arbitrum with $50B+ in lifetime volume. Traders face a USDC liquidity vault that acts as counterparty to every position. When a trader wins, the vault pays. Prices reach the protocol through a signed price feed by oracle. The verifier recovers the signer from each report and checks it against an allowlist. If the address matches, the price is accepted. Identity check, yes. Sanity check on the number itself, no. The attacker operated from inside Ostium's own trusted perimeter: an authorized signer key that produces price reports, plus a registered keeper forwarder, the role that executes pending orders. Both are supposed to come only from governance. With both in hand, the exploit becomes trivial: Open BTC/USD with USDC margin. Execute the open against a self-signed $5K print. Close the position. Execute the close against a self-signed $60K print. Collect the difference from the vault as legitimate trading profit. Everything ran atomically. The fabricated price and the trade landed in the same call, so nothing could step in between. Even the protocol's max profit cap worked for the attacker, setting a predictable yield of about 9x collateral per cycle. The escalation pattern shows how confident they got. A small 1K probe first. Then cycles paying $10K, $90K, $800K, $7M and $5.3M inside a single batch transaction, $11.86M total. Four follow-up runs added $4.5M, $3.6M, $2.7M and $1M. Nearly all of it landed within an hour. The vault went from $32.7M to about $9M, down 72.5%, and the funds are already swapped to ETH and spread across wallets. The oracle infrastructure performed exactly to spec. The failure was a privileged key in the wrong hands. Whether it was stolen externally or misused by someone with access remains unconfirmed. SummerFi lost $6M to the same failure class a week earlier. That's why with @CredoraNetwork we've added OpSec review and parameters to our methodology. And we will continue to upgrading it. Fingers crossed for Ostium to recover funds.

$9 million borrowed against $5 of collateral due to oracle failure. The whole attack took 8 seconds. Here's what happened over the weekend. Why oracles are the most critical part of the system? A blockchain is a closed world. A smart contract cannot check a price on its own. It knows exactly one thing: what its oracle tells it. Every borrow limit, every liquidation, every collateral check in DeFi reduces to a single number delivered by an oracle. The code then executes with perfect obedience. If the feed says your $5 deposit is worth billions, the protocol will let you borrow against billions. The scale of this trust is enormous. Oracles secure billions in value across DeFi today. Every dollar of it depends on price feeds being accurate and verifiers doing their job. The design of the attack. July 11, 00:51 UTC, according to Bonzo's incident report and onchain data: 1. The attacker funded a wallet with 1 ETH from Tornado Cash. 2. They deposited 250 SAUCE as collateral on Bonzo Lend. Value: a few dollars. 3. They submitted a price update to @SUPRA_Labs on-demand oracle contract, inflating SAUCE's price by roughly 12 orders of magnitude. -> SAUCE traded near 0.2 HBAR (~$0.014). The fake update carried a value of 1 followed by 30 zeros. 4. The update was signed with a signature made entirely of zeros. A correctly working verifier rejects that instantly. Supra's verifier contract had a flaw in its signature check and accepted it as valid. 5. Eight seconds after the fake price landed onchain, the attacker borrowed 6.63M USDC and 34.5M wrapped HBAR against the near worthless deposit. Roughly $9.05 million. 6. Over $5.25 million was bridged to Ethereum via LayerZero and swapped into ETH within hours. Read point 4 again. Nobody stole a signing key, that was not an OpSec bridge. The attacker submitted an obviously invalid update and the verifier waved it through. The consequences. Bonzo lost roughly $9.05 million in principal, with total abnormal borrowing at $10.06 million before a white hat returned about $1 million. Bonzo's TVL dropped 77%. Hedera's entire ecosystem TVL fell nearly 40% in 24 hours. HBAR sold off and Korean exchanges Upbit, Bithumb and Coinone issued investor caution notices. Bonzo Lend remains paused while depositors wait for a recovery plan. One broken signature check in one oracle contract took down the flagship lending market of an entire chain and cut the ecosystem's liquidity nearly in half overnight. The conclusion. Bonzo's own lending contracts were not compromised. Hedera's consensus was not compromised. The team did many things right and paused within minutes of the legitimate price returning. None of it mattered, because the protocol inherited the weakest link in its oracle stack. Oracle security is earned through years of adversarial pressure in production: rigorous signature verification, multi-layer validation, deviation bounds that reject impossible prices, robust nodes setup. RedStone has carried billions in value through multiple market crashes with this discipline over the past 6 years. If you are building a protocol, the oracle decision is not a line item. It is the decision that determines whether your users' funds survive contact with an adversary. Your protocol is exactly as strong as the weakest signature check in its stack. Choose accordingly.

Today, Securitize starts trading on the NYSE under $SECZ. This milestone is worth pausing on, because we've been on this journey with them for over 1.5 years now. March 2025. Securitize names RedStone as their primary blockchain oracle partner, covering products like BlackRock's BUIDL, Apollo's ACRED and Hamilton Lane's SCOPE. At the time tokenized RWAs were a roughly $18B market. Securitize was already the trailblazer and largest player in the sector. July 2025. We faced a real problem together. NAV-based funds don't trade on open markets, so there's no price to aggregate, only a single authoritative source - usually a single one. So we co designed and published TSSO, the Trusted Single Source Oracle, a new cryptographic standard for making that single source verifiable onchain. Dual key model, chained signatures, tamper evident by design. February 2026. TSSO moves from whitepaper to production. Our case study showed $580M of BUIDL live on Ethereum with daily onchain valuation and interest accrual, and RedStone delivering daily NAV updates for private credit funds like ACRED and SCOPE that used to run on quarterly cycles. That quarter Securitize also posted 39% revenue growth and $3.4B in tokenized AUM. June 2026. KPK's USDC Prime RWA vault on Euler uses our NAV feeds to price VBILL from VanEck as collateral. Today, Securitize rings in a new chapter as a public company, with $4B+ in tokenized assets brought onchain and over 200 asset managers on the platform. Huge respect to Carlos, Jorge and the Securitize team. We're just getting started on what tokenization can actually do.

Operational security is the most requested diligence point right now. No surprise with such market events. For months, a "quant trading firm" built trust with Drift's contributors. Calls, diligence, the works. On April 1 they cashed it in: they walked the Security Council into pre-signing transactions that handed over admin control, then withdrew $285M against a fake token they'd whitelisted as collateral. A well-engineered operational attack. It wasn't isolated. Seventeen days later, KelpDAO lost $292M when its bridge was used to mint unbacked rsETH. A month before, a single compromised AWS key minted 80M+ USR at Resolv and depegged the stablecoin by 80%. Roughly $600M in H1 2026, and each of these events shares the same pattern of OpSec breach. These threats didn't live in the code. They lived in the setup around it: who holds the admin keys, what those keys can do, how fast a protocol can halt, and whether a backstop works without waiting on a governance vote. No risk rating has ever measured that alongside financial and DeFi risk. Credora now does. Eight Operational Security metrics, built straight from this incident record, folded into the A+ to D scale. Two protocols with identical code and identical audits can now carry different ratings the moment their operational profiles diverge. Access control is the number one way DeFi loses money today. It's finally on the scorecard. Dive deeper into the methodology below.

The reason we acquired @TokenizeThisNYC is simple. We already power the oracle layer for institutions moving capital onchain: BlackRock BUIDL, Apollo ACRED, Hamilton Lane SCOPE, Securitize, Spiko and many more. We are the trusted HIP-3 oracle on Hyperliquid for RWA assets - commodities, stocks, forex. Credora, post-acquisition, adds the risk intelligence layer. Each of these are thoughtful expansion decisions. Security Token Market spent seven years tracking 800+ tokenized securities and building relationships with the people who actually decide where capital flows. The RWA market tripled to $18.6B in 2025. Stablecoins crossed $300B. Tokenized Treasuries hit $7.4B, up 80% year-over-year. That growth didn't happen because the tech got better. It happened because the right people got in the same room and made decisions. Those rooms are back. NYC. Next week. If you're serious about where institutional capital moves onchain, you should be there.

Congrats @YuvalRooz a big milestone for ecosystem growth - TradFi adoption of new tech takes decades to happen and it's been the focus of Canton from early days. Glad to support institutional use cases on Canton with RedStone data 🫡

Congrats @PaulFrambot @MerlinEgalite and the whole Morpho team! The RWA expansion decade is happening, and we are glad to support and power markets with RedStone data feeds and Credora ratings across Ethereum, Tempo, Base and all new chains. Higher.

ElevenLabs Summit in Warsaw with opening speech by president @NawrockiKn 🇵🇱 Couldn’t imagine more majestic venue than the Grand Theater - adequate place to showcase the success of @mati, Piotr and the team. The new wave of Poland-based scaleups is coming.

A few hours ago @zachxbt flagged what looked like a serious exploit on Polymarket. Onchain trackers initially pointed at the UMA CTF Adapter contract on Polygon, with losses reported above $520K and climbing past $660K as the drain continued. As I dig into it now, it seems to be less severe than the first headlines suggested. Not a contract hack, not a UMA issue, it seems that no more funds at risk. According to the team, a 6-year-old private key sitting in an internal top-up config got compromised. Credit to @devjoshstevens and the team for the quick comms response. Key rotated, prod permissions revoked, all PKs moving to KMS. But as we've seen in the past weeks, key compromise is the dominant attack vector now. Contracts get audited extensively. Keys are where the real risk lives. @CredoraNetwork is working on a solution addressing that at a deeper level. Stay tuned.

That's a big one. And more is to come. Extended, the perpetual DEX built by the team behind Revolut's crypto products, just made RedStone Live the data layer behind their RWA markets. 10 markets going live: SPX, NDX EUR, JPY Gold, Silver, Platinum, Copper WTI Crude, Natural Gas 100+ total markets. Up to 100x leverage. Zero maker fees. The roadmap is hundreds of TradFi derivatives markets onchain with the deepest liquidity in the category. Here's the part most people miss. A perp DEX lives and dies by the quality of its price data. Funding rates are calculated from it. Liquidations are triggered by it. If the oracle is slow, the funding rate drifts from reality and someone pays for it. This is hard enough in crypto. It becomes structurally harder when you bring Gold, Crude Oil, and the S&P 500 onchain. Fragmented data sources. Market hours that end while onchain trading doesn't. Price discovery that continues through futures long after the underlying exchange closes for the day. RedStone Live offers institutional-grade primary sources, weighted by how each asset actually trades, signed cryptographically, delivered continuously. Across every mission-critical integration to date: 0 mispricing events. 0 downtime. That's the way to work with global top-notch partners.

XRP Seoul was one of the highlights at KBW 2025. This year it will be only better 🫡 xitter.cf/MarcinRedStone/status/…

Anthropic just declared that any unapproved transfer of its shares is void. The policy covers direct sales, forward contracts, SPVs, and tokenized securities. In practice, this means the on-chain wrappers pricing Anthropic at trillion-dollar valuations confer no equity rights, no claim on the cap table, and now sit under explicit legal challenge from the issuer itself. For context, on PreStocks the Anthropic token implied a $1.5T valuation while the platform held roughly $23M in total assets. Anthropic's last priced round in February closed at $380B post-money. The on-chain mark was effectively 4x the most recent negotiated price, on a venue holding 0.0015% of the market cap it was implying. The consequence everyone is going to learn the hard way is that pricing private equity is a different infrastructure problem than pricing BTC or ETH. Liquid crypto assets price themselves through deep order books across dozens of venues. Aggregation handles the noise. That model breaks instantly when applied to a thinly traded wrapper around a private company that explicitly rejects the wrapper's legitimacy. Illiquid assets need a different methodology. Primary sources. Last verified funding round. Authorized secondary trades. Time-weighted bounds. Conservative inputs that hold up when liquidity dries out or concentrates. Very bespoke and case-driven. Tokenization of equities is happening. The question is whether it gets built on authorized rails with proper pricing infrastructure.

A nation-state-level attack pattern was flagged on Tydro’s oracle infrastructure on May 4th. Markets on Ink paused within hours. No bad prices pushed. No user positions impacted. Then came the harder part: get a new oracle provider live. Fast. In less than 48 hours, RedStone had all needed push feeds live on Ink. Production-ready. Available for builders to use right now. Tydro is built on Ink, Kraken’s L2 bringing 10M+ exchange users onchain. These aren’t side projects. These are serious teams building the next layer of onchain finance, and the infrastructure underneath has to match that ambition. When they needed an oracle partner with both the security standards and the pace to meet the moment, RedStone met all the requirement and extensive due diligence. RedStone powers 200+ protocols with zero mispricing incidents. That track record is what gets you the call when it actually matters. This is also just the beginning of what we’re building together on Ink. Beyond oracle feeds, we’ll be expanding Credora risk ratings and other RedStone products onto Tydro and across the Ink ecosystem. As Kraken grows its onchain footprint, RedStone will be part of the infrastructure layer powering it. Feeds are live. Builders on Ink - start using them now 👇