Alex · On-chain Notes

Reading chains so you don't have to. Prediction markets, tokenized gold & RWA, on-chain data. Mechanisms over hype. NFA.

[Alex · On-chain Notes @alexli_onchain]

@CRYPTOpump990 Let's go!

[Alex · On-chain Notes @alexli_onchain]

Small account, still learning in public. If you're into on-chain data, RWA, or tokenized gold, drop what you're researching right now 👇 I'll follow back everyone in the space and read your stuff.

[Alex · On-chain Notes @alexli_onchain]

@Monerocrypto_ Let's connect! ! !

[Alex · On-chain Notes @alexli_onchain]

@saltapp_xyz of course!

[Alex · On-chain Notes @alexli_onchain]

Data note: Tether's Q3 report puts XAUT backing at ~827k troy oz (~25.7t), up 59% from 16.2t at end-2025. Gold spot was ~$4,120 on Nov 5, about +4% YoY. Ounce growth that large isn't a price story.
For tokenized gold, track supply in ounces, not market cap.

[Alex · On-chain Notes @alexli_onchain]

@ijames_thomas let's connect!

[Alex · On-chain Notes @alexli_onchain]

@AGI_SI_ Let's connect!

[Alex · On-chain Notes @alexli_onchain]

Binance exploit, one week on. The split that matters:

• ~$3B in stablecoins frozen within hours by issuers
• ~$2.4B in ETH/BTC that no issuer can freeze (TRM)

Same theft, two outcomes. Freezability comes from who controls the token contract, not from the chain.

[Alex · On-chain Notes @alexli_onchain]

@Leonardo_Calls Absolutely!

[Alex · On-chain Notes @alexli_onchain]

@tokenterminal One detail that often gets missed: PAXG and XAUT contracts both include issuer admin controls, similar to USDT/USDC. The same mechanism that froze ~$3B of stolen stablecoins this week applies to tokenized gold. Feature or risk depends on your threat model.

[Alex · On-chain Notes @alexli_onchain]

@ItsMoran_ PoR expanding from 10 to 44 tokens is useful, but it's still a snapshot. What would make it stronger after a hot-wallet loss: more frequent snapshots, or some attestation on the liability side? Curious what others would prioritize.

[Alex · On-chain Notes @alexli_onchain]

@KookCapitalLLC Worth separating cause from amplifier: Nasdaq ~-5.5% and BTC ~-5.5% on the same UTC day, ~$1.09B in crypto liquidations (CoinGlass). K33 had flagged thin spot volume + rising perp leverage before this. That combo turns a macro shock into forced selling.

[Alex · On-chain Notes @alexli_onchain]

Data note: Binance's Oct 29 hack took ~$6.34B. About $3B was frozen within days, and most of that was stablecoins: USDT ~$1.57B, USDC ~$0.8B.

The BTC and ETH legs had no freeze button.

What stopped the money wasn't the chain. It was the issuer.

[BLANEY @cryptoblaney]

The Binance hacker might have just pulled off one of the smartest moves I’ve seen in crypto.

First, Tether froze $1.5 billion in USDT.

Then Circle froze another $800 million in USDC.

At that point, it looked like the hacker’s money was trapped.

But apparently, he had already planned for that.

Instead of holding the stolen USDT in a wallet, he allegedly deposited it into Aave and used it as collateral to borrow ETH.

Then he walked away.

That’s where the story gets crazy.

Tether can freeze the USDT sitting in the wallet.

But it can’t freeze the ETH he already borrowed.

So now Aave is left holding frozen collateral, while the hacker is sitting on liquid ETH.

And unless the protocol can recover it somehow, he may not even need to pay the loan back.

Two companies froze billions of dollars in seconds.

But someone who understood how to use DeFi may have found a way around both of them.

Pretty insane when you think about it.

[Alex · On-chain Notes @alexli_onchain]

“98% backfilled” is not “98% recovered”.

Binance says it has covered almost all of the $6.3B loss from its own funds. Elliptic still tracks ~$3.2B in theft-linked addresses, with a negligible amount cashed out so far.

Users are made whole. The stolen funds are another story.

[Alex · On-chain Notes @alexli_onchain]

South Korea’s FSC draft would let stocks, bonds and funds enter a regulated tokenized-securities market from Feb 4, 2027 (consultation open until Nov 11). The open design question is settlement: tokenized deposits, a won stablecoin, or plain bank rails?

[Alex · On-chain Notes @alexli_onchain]

@retiredmafiya let's connect!!

[Alex · On-chain Notes @alexli_onchain]

@judeumeano Let's connect!!!

[Alex · On-chain Notes @alexli_onchain]

Hello X 👋 I’m Alex.

Let's connect!

I’m new here and I’m writing about how stablecoins and RWA actually work, one clear explanation at a time.

Thanks for reading. I’d love for you to follow along.

Leave a comment, I’ll reply to every one and follow you back 🤝

[Alex · On-chain Notes @alexli_onchain]

@mitansh_j07 Agreed. Which makes “how fast can you revoke” the question that matters, not “how fast can you pause.”

[Alex · On-chain Notes @alexli_onchain]

pausing withdrawals didn’t stop the drain, because the EIP-7702 delegation already lived on-chain. With MPC there was no single key to revoke it fast. The withdrawal switch and the wallet’s on-chain permissions are two different off-buttons.

[Quantic @0xQuantic]

A must read for anyone working in crypto.

One of the most important details in the Binance hack is how attackers exploited EIP-7702, a relatively new Ethereum feature.

EIP-7702 allows a regular Ethereum wallet to delegate execution rights to a smart contract without revealing its private key.

After compromising Binance's internal signing infrastructure, the attackers used this feature to authorize a malicious contract to act on behalf of a hot wallet.

The problem was that this authorization existed directly on Ethereum.

Suspending withdrawals or shutting down Binance's systems couldn't cancel it. The attackers could continue moving assets until the authorization was revoked onchain.

And revoking it wasn't straightforward.

Binance used a security system where control of the wallet was split across multiple parties, rather than relying on a single private key. That made it harder to quickly issue the transaction needed to remove the malicious authorization.

EIP-7702 didn't cause the initial breach. But it gave the attackers a way to maintain control that Binance couldn't immediately shut off.

An important case study in why securing wallet infrastructure also requires understanding what permissions can survive a system shutdown.