Karim (@markhker) header
Karim (@markhker) profile picture

Making tokenized real estate + prediction markets make sense for everyday people. Building @lofty_ai + @alphaarcade on Algorand.

Cancun
Joined October 2011
Photo by Karim (@markhker)Photo by Karim (@markhker)Photo by Karim (@markhker)Photo by Karim (@markhker)Photo by Karim (@markhker)Photo by Karim (@markhker)Photo by Karim (@markhker)Photo by Karim (@markhker)Photo by Karim (@markhker)Photo by Karim (@markhker)
I work inside two of finance's most interesting experiments: tokenized real estate @lofty_ai and prediction markets @alphaarcade Most of what you read about both is hype. I'll show how they really work, with real numbers. Curious but not technical? Follow along.
7
7
46
1,561
Nvidia's board news hit after the closing bell, so for hours most of the price action was in perps and prediction markets, not the stock. OKX and ICE's 24/7 tokenized stock venue opens Nov 23. Twelve days late for this one. nitter.gq/Polymarket/status/2120…
BREAKING: Nvidia perpetual futures plunge as reports emerge that the company's board is preparing to oust CEO Jensen Huang.
13
The AI part gets the headline, but the chain is old stuff: a ClickHouse with no password, a misconfigured logrotate to get root, and wallet keys sitting on an internet-facing server. The agents just make checking 5,900 IPs cheap. nitter.gq/fr0gger_/status/212068…
🧐 We identified a new crypto theft campaign that uses Claude Code agents to attack Solana validators and MEV-bot servers and steal private keys and drain wallets! @SecurityBreakAI The operation uses a project called MevBotResearch, with two custom agents defined in .claude/agents/: hunter.md and exploiter.md. The agents target approximately 5,900 IPs collected from Solana gossip data, GitHub and npm. They search for exposed ClickHouse, Redis, Docker, Grafana, Solana RPC and SSH services. In one confirmed attack: - They accessed a passwordless ClickHouse instance and abused url() for SSRF. - Escalated to root through a misconfigured logrotate service. - Stole private keys from /home/sol/keys and drained wallet balances above 0.02 SOL in approximately 5 seconds. The attackers also delegate tasks to GLM, under the pretext of an "authorized red-team engagement". If you operate Solana infrastructure, review your exposed services, SSH access and private keys stored on internet-facing systems. IOCs in next tweet 👇
1
70
Building an NBA combo tonight? On @alphaarcade you can now mix prediction-market picks and sportsbook picks in one basketball combo and the whole thing gets priced in one go. Same for hockey, baseball and tennis.
1
3
205
Investing in Lofty from outside the US got less annoying: you can now update your bank account details after the first setup, instead of getting stuck with whatever payout info you entered on day one.
1
5
149
Kalshi had Jensen leaving as Nvidia CEO before 2028 at 35% on Monday. Tonight it hit 61% on the second affair report, and Polymarket's end-of-year market was at 75% minutes after the board story broke. This guy... nitter.gq/Polymarket/status/2120…
BREAKING: Nvidia's board is preparing to oust CEO Jensen Huang. — WSJ
1
196
Waiting on a payout after the final whistle is the worst part of a winning pick. Alpha Arcade now settles Europa League, Spain's second division, Portugal's Primeira Liga and UFC method-of-victory markets automatically from verified results, so winners get paid sooner.
5
13
304
The number to watch is the small one. RWA xyz counts $418B of "represented" assets, where the chain is just a record and holders usually can't move the token. Only $39.9B is "distributed", tokens that actually move between wallets onchain.
THE RWA MARKET IS GROWING, BUT THE NUMBERS SHOW WHERE IT REALLY STANDS. I have been looking deeper into the latest tokenization data, and one distinction stands out. According to @RWA_xyz’s November 11 snapshot: ▹ $39.89B in distributed RWA value. ▹ $418.09B in represented RWA value. ▹ 5.72M RWA holders. ▹ 217 tokenization platforms. These figures measure different things. Distributed assets are available through onchain infrastructure, while represented assets use blockchain for recordkeeping without necessarily being freely transferable by investors. A blockchain record of an asset does not automatically make that asset fully available onchain. ⊹ TOKENIZED STOCKS ARE GROWING RWA.xyz records: ▹ $3.88B in distributed tokenized stock value. ▹ 4.81M holder addresses. ▹ 6,794 listed asset entries. ▹ $39.59B in 30-day transfer volume. There is another side to these figures. Over 30 days, value increased 13.41% and holder addresses grew 8.11%, while monthly active addresses declined 66.47% and transfer volume fell 51.73%. More holders do not automatically mean more trading activity. Also, transfer volume is not necessarily exchange trading volume. ⊹ TRADITIONAL FINANCE IS BUILDING On October 28, @The_DTCC launched its Tokenization Service, allowing eligible participants to create tokenized representations of securities held within its depository. These retain the ownership rights, economic entitlements and investor protections of their traditional counterparts. Twenty participants had signed agreements to access the service at launch. Initial network integrations include @CantonNetwork and DTCC’s private Besu network. This connects existing securities infrastructure with blockchain-based systems. ⊹ NYSE AND AVALANCHE On November 9, @NYSE selected @avax technology for the core ledger of the clearing infrastructure behind its planned tokenized securities platform. The proposed platform targets 24/7 trading and settlement, using NYSE’s existing Pillar matching engine. It remains subject to regulatory approval. This is a planned development, not an operational tokenized exchange. ⊹ INTERNATIONAL EQUITIES ARE EXPANDING On November 11, Payward, Kraken’s parent company, announced more than 200 additional UK and European equities through xStocks, developed by @BackedFi. Payward reports over 1,500 tokenized assets, $1.1B in AUM and $45B in cumulative transaction volume. The tokens are backed 1:1 by underlying shares held with a regulated custodian. However, tokenized exposure does not automatically mean direct share ownership or identical shareholder rights. ⊹ WHAT CONNECTS THESE DEVELOPMENTS Three layers are developing: ▹ Issuance and distribution: @OndoFinance, @Securitize and @BackedFi bring traditional financial products into blockchain-based distribution. ▹ Trading and liquidity: Platforms provide ways to access, transfer and trade tokenized assets. ▹ Clearing and settlement: @The_DTCC and @NYSE are exploring blockchain infrastructure for recording, transferring and settling securities. These functions are connected, but they are not interchangeable. An asset can be tokenized without meaningful liquidity or freely transferable ownership. ⊹ WHERE THE OPPORTUNITY LIES The next phase of RWA adoption will depend on more than how many assets are issued onchain. It will depend on reliable issuance, legal ownership, custody, compliant distribution, liquidity, interoperability and settlement. It will also depend on whether eligible tokenized assets can be used as collateral and integrated into financial applications without weakening investor protections. Tokenization is moving beyond putting traditional assets on a blockchain. The larger ambition is to connect them to a more programmable financial system. That is the development worth paying attention to. This is my opinion based on the data I’ve reviewed, not financial advice.
1
42
Buying a Miami condo because GTA 6 drops next week is the most crypto real estate thesis I've seen. The game launches once. The mortgage, HOA and insurance show up every month after that, so the rent had better cover them nitter.gq/Polymarket/status/2120…
JUST IN: Crypto influencers are purchasing Miami apartments ahead of GTA 6's release, expecting the game to drive up local real estate prices.
40
Most of those hundreds of AWS calls came back AccessDenied, and one intrusion still ended with a production secret. Automated tools don't get discouraged by denials. They only need one credential in a config file with more access than the app needs.
🚨 Hackers weaponize AntiFox AI agents to breach servers and steal AWS production secrets Security researchers at Arctic Wolf have uncovered attacks using AntiFox, an open-source AI-powered penetration testing platform, to compromise internet-facing servers and steal sensitive AWS credentials. Attackers hosted AntiFox on Alibaba Cloud infrastructure, deploying webshells, extracting database credentials, and abusing legitimate AWS identities to access cloud environments. In one intrusion, attackers made hundreds of AWS API requests in just 30 minutes, successfully obtaining production secrets. Another incident involved unauthorized access to Amazon S3, where attackers read, copied, and deleted stored files. The findings highlight how AI-powered hacking tools are increasingly being used in real-world attacks to automate reconnaissance and credential abuse.
15
Land is a great asset right up until you need the money this week. It sits because the buyer pool is small and the paperwork is often messy. Selling small shares to a bigger pool helps with the first. Only a clean title fixes the second. nitter.gq/Mrbankstips/status/212…
Buy Land Buy Land Na when you need urgent funds your body go tell you
16
Every gym membership I ever had fizzled out. What finally stuck was paying a personal trainer, because skipping meant throwing away money I'd already spent. The fear of wasting money got me in better shape than motivation ever did.
1
42
Tokenized stock doesn't always mean you own the stock. Kraken's xStocks just added 200+ UK and EU names, backed 1:1 by shares, but its own disclosure says holders don't own them. On Lofty each house sits in its own LLC, and your shares are membership in it, with a vote 😏
1
39
It started with a GitHub issue. Codex was set to read and label new issues, so the issue text became instructions. Then a sandbox escape, stolen CI tokens, and a path to publishing the official Codex npm package. Now fixed, no bad release reported.
🚨👾First post → Awesome research. We compromised the latest version of OpenAI Codex. We prompt injected. We escaped a sandbox. We exfiltrated secrets… And ended up with control over what could be published to the official openai/codex npm package. Prompt injection → RCE → supply chain compromise. Full research by @0xMadder and @_Worty in the comments 👇
1
7
215
For tonight's games: Alpha Arcade now shows each live game as one card with score and clock. Live picks are priced from prediction-market prices first, so live combos get a price more often. Sportsbook combos also stay open once a game starts.
1
2
1
9
204
The first thing I bought for my computer with my own money was an 80GB hard drive from Plaza de la Tecnología in Mexico City. My phone laughs at 80GB now. Back then it felt huge.
18
From Nov 23, Coinbase and Circle stock tokens trade 24/7 here, settled to your own wallet. On Sundays NYSE is closed, so the price is whatever buyers and sellers agree on. Monday's open checks their work. Lofty shares already trade like that 😉
OKX and ICE Are Bringing US Stocks Onchain Cryptocurrency exchange OKX (@OKX) and Intercontinental Exchange (@ICE_Markets) will launch the OKXICE Tokenized Securities Venue on November 23. The platform aims to bring traditional US capital markets onto blockchain rails and enable 24/7 trading of tokenized stocks. According to the announcement, these tokens will be pegged one-to-one to underlying securities and will settle into users' personal wallets.
4
99
Core parts of Signal's encryption now have machine-checked proofs, down to the compiled code. Real progress. Most attacks skip the math anyway. They phish the person, grab an unlocked phone, or use a leaked key, like the Initia hack this week.
JUST IN: Google DeepMind announces its Gemini agents have “mathematically verified” Signal's cryptographic protocol in just 4 weeks.
35
Part 2: selling. Lofty has no holding period. You can list your shares on the exchange 24/7, two ways: Limit order: you set the price, it fills when another investor matches it. Market order: sells right away at the best available price, plus a 2.5% fee for instant execution.
1
25
Sales carry a 3% fee. Selling anytime doesn't mean sell at what you paid. The price is what a buyer will pay.
13
How the hack worked: Initia, Nov 9. No smart contract bug this time. It started with one leaked Google Cloud key, the kind used to spin up servers. Here's the chain, step by step:
2
2
4
264
From there they reached Anvil, the platform that hosts Initia's rollups. With that access they could approve withdrawals that never happened on the rollups, and the main chain released real assets from escrow. About $3.27M moved.
1
1
46
The attacker cashed out until hitting the bridge's outbound rate limits, then the chain was halted. $2.16M is still frozen there, and Initia says it will restore the backing of affected assets in full.
28