Your Tokenized Stock Is Five Promises and One Ledger

Somewhere in a US brokerage account there is a share of Tesla you will never see.

It is the only reason your token is worth anything.

A tokenized stock is a claim on a claim on a share, which Article 1 unpacks in detail. This piece is about the machinery underneath that claim: how a token gets created, what has to stay true for it to keep meaning something and the order in which things fall over when they do.

Here is the thing that surprised me most while assembling this. The blockchain does almost none of the work. It does one step, it does it in under a second and it is the only step in the whole sequence that can prove it happened. Everything else is a company filing a document, a broker placing an order, an accountant checking a balance on a Tuesday.

That asymmetry is the whole story. Let’s build it up piece by piece.

The mint loop has four steps and a blockchain only does one of them

Minting a tokenized stock works the same way at every major issuer, with local variations. Four steps, in order:

1. Money in. An eligible investor sends dollars or stablecoin to the issuer. Not everyone is eligible. Primary minting is usually gated to onboarded partners, market makers and qualifying investors, even where the resulting token trades freely afterward.
2. The buy. A licensed broker dealer buys the actual share on a real exchange. Dinari, an SEC-registered transfer agent — the entity that keeps a company’s official shareholder register — states that a mint happens only when a corresponding brokerage order completes.
3. The vault. That share goes to a regulated custodian in a segregated account. Backed Finance, the issuer behind xStocks, uses InCore Bank in Switzerland under a three party structure with an independent security agent. Ondo and Dinari both route through Alpaca Securities in the US.
4. The mint. The issuer creates the token and sends it to the investor’s wallet.

Redemption is the same list read backwards. You send tokens to a burn address, the issuer destroys them, sells or delivers the underlying share and wires you fiat or stablecoin. Backed’s published flow settles redemptions in cash or USDC within three business days.

Step 4 is the blockchain step. On Solana it takes roughly half a second and costs a fraction of a cent. It is also the only step in that list that leaves a public, timestamped, independently checkable record.

Steps 1 through 3 happen in private databases at private companies. So does the sell side of every redemption.

Call step 4 Link 0. It is free, fast and trustless in the narrow sense that nobody has to take anyone’s word for what the token ledger says. Link 0 is not where your risk is. Link 0 basically always works.

Meet the Backing Chain

Everything that has to hold true for your token to be worth a share sits in five off-chain links. I’m going to name them, because naming them makes the rest of this piece much shorter. Together they are the Backing Chain.

Link 1 — The Buy. A broker actually bought the share and the trade actually settled.

Link 2 — The Vault. A regulated custodian actually holds it, segregated, unencumbered, in a legal wrapper that survives the issuer going under.

Link 3 — The Count. Somebody independent checks that tokens outstanding equals shares held.

Link 4 — The Wire. Price and corporate-action facts get carried on-chain accurately and on time.

Link 5 — The Exit. You can burn the token and get the value out.

Link 0 verifies itself. Links 1 through 5 are promises made by companies. The blockchain cannot see any of them, cannot check any of them and will happily keep transferring your token at full speed if all five are broken at once.

Now walk the links.

Link 1: the token can exist before the share does

US equities settle T+1 — one business day between trade and legal transfer. Tokens settle in seconds. Those two clocks do not line up and the gap has a name in the attestation world.

Jeremy Nau of The Network Firm, writing on tokenized stock reserve reporting in August 2026, put it about as plainly as it can be put: “If the issuer mints when a user buys rather than when the trade settles, the token exists before the share does. Over a weekend that window runs three days.”

Read that again, because it is the sharpest sentence anyone has written about this product. An issuer that mints on order rather than on settlement can be genuinely, arithmetically undercollateralized across most weekends and still show a clean 1:1 ratio at every Monday through Friday measurement point.

This is not an accusation against any specific issuer. Practice varies and most don’t publish which convention they use. It is a question worth asking your issuer directly and one that a good reserve report is supposed to answer.

The gap got structurally more interesting on 25 June 2026, when Ondo turned on 24/7 minting and redemption for six of its tokens — SPYon, QQQon, CRCLon, NVDAon, TSLAon and GOOGLon — moving from a 24/5 window that had tracked Wall Street hours. Minting on a Saturday means creating a token against a share you cannot buy until Monday, unless you already hold inventory or a hedge.

I read Ondo’s announcement looking for how that inventory is sourced. It isn’t disclosed. That may be entirely fine and well collateralized. It’s just not visible, which is the point of this whole article.

Link 2: 94% of the collateral sits with one broker

This is the number that reframed the category for me.

Alpaca Securities, a US licensed broker dealer, says it custodies about 94% of tokenized US stocks and ETFs. Its assets under custody backing those tokens were $480M as of 4 December 2025 and roughly $1.5B as of late July 2026. Its clients include Ondo, Backed’s xStocks and Dinari — meaning the two largest issuers by size both sit on the same custody rail.

Set that against the tokens themselves. xStocks settles on Solana and is withdrawable to Ethereum, TON and Ink. Dinari runs on Ethereum, Arbitrum and Base with Plume added in 2026. Ondo launched on Ethereum, then BNB Chain. Five or six chains, several dozen venues, one broker underneath nearly all of it.

The distribution layer is genuinely decentralized. Link 2 is a single address.

Ledger Insights, reporting the December 2025 figures, added a second concentration on top of the first: six stocks accounted for roughly three-quarters of all tokenized stock holdings, Tesla and Nvidia among them. Robinhood, which does not use Alpaca, held $12M at that point.

Two numbers, one caution. The ~$2.5B of on-chain tokenized stock value in mid August 2026 and Alpaca’s $1.5B of shares under custody in July 2026 measure different things at different dates. Don’t divide one by the other. They are separate readings that happen to point the same direction.

Link 3: proof of reserve proves a moment, not a month

Proof of reserve is the industry’s answer to “how do I know the share is really there,” and it does real work. It also gets oversold constantly, including by people who should know better.

Two different things wear the same label. A CPA attestation is a human engagement under standards like AT-C 205 or AT-C 215, where an accountant examines the custody account and issues a report. A Chainlink Proof of Reserve feed is an automated oracle — a service that carries off-chain data onto a blockchain that publishes a reserve balance on-chain where a smart contract can read it. Chainlink ran over 40 active PoR feeds covering more than $17B in reserves as of mid 2026.

The feed solves the staleness problem. A quarterly report leaves a quarter long window in which reserves can drift with nobody watching. A feed updates continuously.

But the feed reports what its source tells it. If the source is a custodian’s API, then a continuously updated feed is a continuously updated restatement of one company’s own database. That is better than nothing and much better than a PDF from last quarter. It is not independent verification and Chainlink’s own guidance draws the distinction, recommending data come from custodians or auditors rather than the issuer and separating proof of reserve from proof of solvency.

Here is what a serious tokenized stock reserve engagement does and does not reach.

The bottom right cells are where the failures live. Nau’s framing of the operational column is the useful one: legal segregation does not prevent a shortfall created by mint timing, fractional rounding, an unadjusted corporate action or an encumbered reserve account.

The xStocks audit claim, precisely

You will see xStocks described as having no audits. That claim traces to an October 2025 analysis headlined “58% Market Share, Zero Audits,” and it deserves to be repeated accurately rather than loudly.

The criticism in that piece is about smart contract audits and open source transparency, not about reserve verification. On the reserve side, Backed publishes per-ticker documentation and proof of reserve data via Chainlink and secondary reporting describes quarterly ISAE 3000 engagements by The Network Firm alongside weekly on-chain PoR updates. I could not open Backed’s primary documentation directly to confirm that cadence, so treat the frequency as attributed rather than verified.

Two different audits, two different questions, one confusing headline. The broader and better supported point is Nau’s: as of August 2026, the number of formal CPA attestations across tokenized stock issuers was extremely low.

Link 4: an oracle decides what your token thinks a dividend is

Corporate actions are where tokenization stops being a wrapper and starts being an operating business.

A stock splits. A company pays a dividend. Another gets acquired. At the custodian, the asset changes. On-chain, nothing changes until somebody makes it change and the mechanism that makes it change is Link 4.

Most issuers use a scaling factor rather than minting and burning for every event. Backed maintains a global on-chain Multiplier for xStocks: your effective balance is your raw balance times the current multiplier and a split or a dividend moves the multiplier. Chainlink’s Ondo feed does the same arithmetic in the price direction, publishing token price as underlying equity price multiplied by the issuer’s scaling value.

Dividends themselves diverge by issuer and the divergence matters more than it looks. The standard model distributes pro-rata to holders at the ex-dividend record block — the block that fixes who was holding when the payout was set — usually in USDC. Dinari pays out that way. Backed instead reinvests: your xStocks balance grows via the multiplier and no stablecoin arrives. Robinhood adjusts token quantity for splits in account.

Same word, different cash flow, different tax event. Check your issuer’s convention before you assume a dividend shows up as money.

The failure mode here is timing, not honesty. Chainlink’s Ondo feeds pause around major corporate actions: the pause is scheduled at least 24 hours ahead, the feed freezes at the last known good price, a minimum 10 minute halt is enforced and normal operation resumes only after Ondo confirms alignment. That is careful engineering and it is also an admission that for a defined window the on-chain price is deliberately stale by design.

Anything reading that feed — a lending market, a liquidation engine is reading a frozen number. What happens when a stale oracle meets a fast market is Article 4’s subject.

Voting is the honest gap. Most tokenized equity conveys no direct voting right. Some structures pass economic value on tender offers and mergers case by case under the prospectus, without passing the vote. Verify per issuer.

Link 5: the exit is a contract, not a smart contract

Redemption is minting in reverse and on-chain it is trivial. Tokens go to a burn address, supply drops, the record is public.

Everything after that is a company doing things. Selling the share. Waiting for T+1. Moving cash. Backed’s flow lands fiat or USDC with you within three business days.

And redemption rights are not universal. At several issuers the right to redeem at the primary window belongs to onboarded, eligible parties, not to whoever ended up holding the token after four transfers on a decentralized exchange. If you cannot redeem, your exit is the secondary market, which means your exit is whatever the order book says at that moment. Article 3 maps who actually holds redemption rights at each platform.

The failure tree: what breaks and how you’d find out

Order matters here. Failures propagate down the Backing Chain and the earlier the link, the longer it stays invisible.

Notice the shape. The cheapest failures to detect are the ones the blockchain can see and the blockchain can only see Links 3, 4 and 5 partially and Links 1 and 2 not at all. Link 2 failing is a market wide event with a delayed symptom. Link 1 failing may never produce a symptom at all.

That inversion is the design flaw worth carrying around. The failures that are easiest to spot are the least consequential. The one that would matter most sits with a broker in California whose name most token holders have never heard.

What I actually think

I think the industry’s transparency effort is aimed at the wrong link.

Enormous care goes into Link 3, the count, because the count is legible and it produces a nice green number. Comparatively little public disclosure covers Link 1, the settlement convention and Link 2, the concentration. Those are the links where a real failure would start.

None of this makes tokenized equity fake. The share is usually there. The custodians are usually regulated. The attestations, where they exist, are usually real work by real accountants. The product does what it says on most days.

But you should know what you’re trusting and it isn’t math.

A share sits in a brokerage account in the United States. Five companies keep five promises about it. The blockchain records the last one.

This is part 2 of a five-part series on tokenized equities. Nothing here is investment advice. All figures are current as of September 2026; this market moves fast, and some of these numbers will be wrong by the time you read them.