Robinhood Chain went live on 1 July 2026 with 200-plus tokenised stocks, Uniswap liquidity and Chainlink feeds — and a permissionless deployer surface reaching 23 million retail users. Within days, the failure modes were documented.
Relay Protocol flagged advanced honeypots on the chain that remove holdings from the buyer's wallet after purchase — hidden transfer logic that burns or claws back balances, or drains through the approval granted during the swap. Funds spent are effectively unrecoverable.
Relay warning, 10 Jul 2026Anyone can deploy a contract on the chain without KYC, so a token can imitate a legitimate issuer or a real Stock Token symbol. When Robinhood's own CEO account was hijacked in July to push a token, the lesson was blunt: a trusted name in front of a contract proves nothing about the contract.
Impersonation after the X hackEven legitimate Stock Tokens carry mechanics worth reading: an ERC-8056 UI multiplier that integrators can apply twice, an oraclePaused flag that is advisory rather than enforced on-chain, one authorised party controlling every mint and redeem, and a single sequencer ordering all of it.
26 signals, one score, the reasoning attached. Read-only — the agent never signs and never asks for an approval.