Three of the four tokenized stocks we measured were fakes

What we were doing, and what went wrong

Coinbase's tokenized equities are issued under B20, an extension of ERC-20 on Base. Base's documentation lists the thirteen contracts and their addresses, and every one of them sits in a distinctive address space beginning 0xb200000000000000000000. That looked like a clean way to find the asset class in on-chain trade data, including any tickers issued after we wrote the query. So we matched on it.

The match returned 7,532 distinct tokens. The prefix is a shared namespace on Base, not an issuer credential: it identifies a token as B20, and says nothing at all about who issued it or what it claims to represent. Filtering those results down to the four live equity tickers still left the wrong answer, because for NVDAc, AAPLc and METAc the highest-volume contract carrying that ticker was not Coinbase's.

We caught it on a sanity check: the impostor contracts had first traded on August 12 and 13, before the August 24 launch. Had the fakes been deployed a week later, the numbers would have looked ordinary and we would have published them.

Every shortcut fails

We then tested each signal someone might use to tell a real tokenized share from a fake, against Coinbase's NVDAc and against the impostor that outranked it.

The decimals and supply columns need care, because the obvious reading of them is wrong. It is tempting to say the impostors are detectable because 18 decimals and a round billion supply look like a memecoin. They do. But we checked five ordinary, unrelated tokens in the same namespace (Basecat, Baseline, plumber, Meow, BLUE CHIP) and every one of them is also 18 decimals, and four of the five also have exactly 1,000,000,000 supply. That is simply the default for a token minted on Base.

So the impostors do not look wrong. Coinbase's tokens look unusual. They carry 8 decimals and a total supply that is a share count, 12,640.08 shares of NVIDIA, because they are backed one-for-one by real shares in custody. The check works only if you already know what the genuine article looks like, which is the same thing as already knowing the answer.

What the fleet looks like

Ten of the thirteen contracts share one shape, and it is a machine, not a person:

• A fixed window. Each ran between 28.9 and 30.0 minutes from first trade to last, mean 29.5. Then it stopped and never traded again.
• Real counterparties. 58 to 71 distinct takers each, 635 taker-slots in total, $254,910 of volume, averaging $401 a head. Largest single trade across all ten: $1,005.
• All four live tickers, over four separate days: August 24, 26, 27 and 28. The first landed on launch day.

The remaining three contracts are a different pattern: all three forge COINc, all three have a single counterparty, and two of them moved $101,912 and $36,970 inside half an hour on August 30 with nobody else involved. We are not going to characterise what that is on this evidence.

Total across all thirteen: $393,805. Set against the $242.0M the genuine tokenized equities traded in the same period, this is small, and we are not going to inflate it. The finding is not the dollar figure. It is that a repeatable, automated impersonation ran on launch day against an asset class whose whole proposition is that it is backed by something real, and that nothing in the token's own presentation gave it away.

The one check that works

Compare the contract address against the issuer's published list, obtained from the issuer. That is the whole of it. Not the ticker, not the name, not the address prefix, not the shape of the supply, and not any of it as rendered by a third-party interface that resolved the token by symbol.

This is an unsatisfying answer, and it is worth being honest about why. It moves the trust question off-chain: you now have to trust the channel that gave you the list. It does not scale to a person scrolling a token picker. And it means that for this asset class, the convenience features of every DEX front end, searching by ticker, are the attack surface.

Why this matters

The premise of a tokenized share is verification. A memecoin with a stolen ticker costs its buyer money. A tokenized equity with a stolen ticker costs its buyer money and damages the thing that makes the category worth having, which is the claim that the token is backed one-for-one by an asset somebody is holding. The impersonation is cheap; the credibility it borrows is not.

Automated pipelines inherit the same blindness. We are a forensic measurement service and we got this wrong on the first attempt using the issuer's own documentation. Any dashboard, index, tax tool, or research note that resolves these tokens by ticker or by address prefix is exposed to exactly the same error, and unlike us it may have no launch-date anomaly to trip over.

The usual tools do not transfer. Bytecode fingerprinting is how cloned and forged contracts are normally caught. In this namespace every contract answers 0xef, so that technique returns nothing, for the genuine tokens and the fakes alike.

What is still open

• We did not identify who deployed these. The free contract-creation lookups do not cover Base, and we did not want to assert a fleet operator we cannot evidence. Ten contracts sharing a 30-minute cycle is a strong hint of one actor, and a hint is all we have.
• We did not check whether the same counterparties appear across contracts. The 635 taker-slots may be fewer distinct people.
• Our impostor search only catches contracts inside the B20 namespace that also carry a canonical ticker. An impersonator at an ordinary Base address is not counted here, so thirteen contracts and $393,805 are floors, not totals.
• Nine of the thirteen issued tickers have no trading yet, and several have no supply issued. As the rest come online this measurement needs re-running, and there is no reason to expect the impersonation to stop.

If you are building on this asset class

If you run an interface, an index, or a dashboard that lists tokenized equities and you want a second pair of eyes on how you resolve them, or you can identify the deployer behind these contracts, I want to hear from you: andrew@cleartracedata.com. The address list and the impostor set are open, and corrections go back into the public data.