1,300 Tokens and Not One Merkle Root: XT Exchange's 'Asset Discovery' Campaign, Audited

Hook

Here is a sentence that should stop you cold.

In the promotional copy for XT Exchange's 'Build the NeXT' campaign, the exchange's COO, Arman Achmed, is quoted saying that a listing announcement should be read as the opening of a market, not a judgment on the project.

Sit with that for a second. Then read it again alongside the other quote in the same document: listing is a responsibility, not a favor.

Those two statements cannot both be true. One claims a duty of care. The other pre-emptively disclaims it. A financial venue that says 'we take this seriously' and 'do not read anything into what we list' in the same breath has not made a promise. It has made a legal shield and dressed it as a philosophy.

I have spent the last week reading the XT material the way I read a contract before I sign it — not for what it says, but for what it very carefully does not. I counted the disclosures. I counted the silences. The silences won by an embarrassing margin. No proof of reserves. No audit report. No license. No jurisdiction of incorporation. No listing standard. No Launchpad performance history. No active user figure. No named CTO, no named founder, no investor list. In a document that runs long enough to mention RWA markets, TradFi exposure, a payments product, a Launchpad, spot, leverage, and perpetual futures, the word 'license' does not appear once.

That is not an oversight. Nobody accidentally forgets to mention their regulatory permissions in a brand campaign. When a financial institution systematically omits its compliance posture from its own marketing, the compliance posture is the thing they are marketing around.

Code doesn't care about your feelings. Neither does a withdrawal queue at 3 a.m. on a Sunday.

Context

To be fair to XT — and I will be, because a dishonest audit is worse than no audit — the framing problem it describes is real. The 2024 approval of spot Bitcoin ETPs in the United States did change the conditions of asset discovery in a structural way, and not in the direction most retail traders believe.

Before the ETPs, capital entered crypto through a fragmented set of on-ramps and dispersed across thousands of assets, because there was no regulated vehicle that let an allocator express a Bitcoin view without picking a custodian and a chain. After the ETPs, an entire class of capital — pensions, endowments, RIA-managed accounts, family offices with actual compliance departments — gained a clean, audited, custody-solved path into exactly one asset. That capital did not become more adventurous. It became more concentrated, because the wrapper made the concentration cheap.

So the post-ETP market is not a market where everything gets discovered. It is a market where Bitcoin got a moat and everything else got a marketing problem. Liquidity pooled in the top of the asset list, and the long tail — the thousands of tokens that used to catch rotational flows during alt seasons — found itself competing for a shrinking share of attention and an even smaller share of genuine depth.

XT's read on that is correct. The document argues that we have moved from an era of 'discovery for all' into an era of 'attention scarcity', where the binding constraint on a new token is no longer creation — creation is free, anyone can deploy a contract in ninety seconds — but visibility. That is a sharp observation and I want to give credit where it is due. The diagnosis is right.

Where it falls apart is the prescription. Because if the constraint is visibility, then the solution is not to increase the supply of visible things by thirty percent. That is like treating a crowded room by inviting more people.

Let me set the competitive baseline, because XT's campaign never does. The self-reported figure is 1,300+ supported tokens. Against that: Gate.io has operated since 2013 and carries thousands of pairs. MEXC has built its entire identity around being the fastest listing venue in the market, also with thousands. Binance and Coinbase sit in the hundreds, deliberately, because depth and compliance cost money per asset. Upbit dominates a single jurisdiction and lists a fraction of any of them.

The tier structure matters. Tier one wins on depth and regulatory standing. Tier two wins on breadth or speed. XT has positioned itself as a breadth venue in a breadth market that already has two entrenched incumbents, one of which has a five-year head start and the other of which has a speed advantage XT cannot match without abandoning its own risk controls. That is the actual strategic situation, and the campaign paper does not acknowledge it once.

Instead, the 1,300 number is reframed as a stance. The document literally says this is 'a position, not an accident'. I want to examine that claim mechanically, because this is where the marketing language meets the order book.

Core

The mechanics of 'discovery' nobody wants to publish

An exchange listing does not discover an asset. A listing creates a market, and a market is a mechanism with measurable properties: depth at the touch, spread, slippage curve, maker-taker composition, and the shape of the book under stress.

For a top-of-book asset, none of this matters much — Bitcoin on any venue has a book thick enough that a retail order is invisible. For the long tail, it matters entirely. And here XT's own campaign document makes an admission that undercuts its central claim. It notes, in passing, that in newer markets, price moves on a smaller volume.

That is a polite way of saying the order books are empty.

I want to be precise about what 'empty' means, because this is the part retail traders consistently fail to price. When a book has four levels on the bid and three on the ask, and the total resting liquidity between the current price and a 20% drawdown is smaller than the daily withdrawal volume, the market is not price-discovery — it is a controlled demolition waiting for a trigger. Any single actor with a five-figure balance can walk the book. Any listing announcement that says 'the price moved 40% on low volume' should be understood as a liquidity event, not an information event. Coins don't care how good the project is; the order book is a machine that turns order flow into price, and if the flow is absent, the price is fiction.

There is a second-order consequence that almost nobody computes. Thin books don't just produce volatile prices. They produce reproducible prices, which means they produce arbitrage for whoever can move the book and mark the next participant's liquidation. In a venue with 1,300 pairs and a book depth distribution heavily weighted toward the tail, the tail is not a discovery service. It is a harvest.

I've been on the other side of this trade. In 2020, during the DeFi Summer sprint, I moved sixty percent of my book into Uniswap V2 pools and rebalanced daily across ETH/DAI and SUSHI/ETH. I earned north of 400% in three months, and I want to be honest about where that yield came from: not from the protocol's brilliance, but from the fact that I was participating in a market whose depth I could measure on-chain, in real time, with a subgraph query. I could see the pool. I could see the reserves. I could compute impermanent loss before entering.

On a centralized order book venue with 1,300 pairs, I cannot see the reserves. I cannot see the maker inventory. I cannot see the market maker agreements. I can only see the top of book on a webpage that is under no obligation to show me anything else.

Yield is the bait, rug is the hook. The bait here is 'access to early assets'. The hook is that access to a market with no depth is not access to an opportunity. It is access to a slippage curve you did not model.

The arithmetic of 1,300 listings

Let me do the math the campaign document does not do.

XT was founded in 2018. Call it eight years of operation. 1,300 tokens over eight years is roughly 160 listings per year, or a bit more than three per week, sustained, for nearly a decade. That is a real operating cadence and I don't dismiss it — running 1,300 order books with 1,300 sets of reference prices, funding rates, liquidation engines, oracle feeds, and risk parameters is genuinely non-trivial engineering. Anyone who thinks a CEX is 'just a database' has never watched a matching engine fall over under load.

But the cadence has a cost that is never disclosed: due diligence throughput.

Every listing requires at minimum a contract review for dangerous permissions — mint authority retained by the deployer, blacklist functions, pause functions, unlimited upgradeability, transfer taxes, honeypot sell restrictions, hidden owner-only fee setters, proxy patterns with an admin key. That is the floor, not the ceiling. Above it sit tokenomics review, unlock schedule analysis, team background verification, liquidity commitment assessment, and jurisdictional screening of the issuer.

A serious review of a single token contract is not a ten-minute job. My first real audit engagement, the 2017 0x Protocol relayer node code, took me six weeks of reading Solidity on GitHub before I was confident enough to publish three re-entrancy findings. Those were three findings in one codebase, and I had no deadline, no pressure to list, and no commercial relationship with the team.

A venue listing 160 assets a year, at three per week, with an incentive to move fast because listing is its revenue source, has a structurally different review posture than a venue listing thirty a year. This is not an accusation of bad faith. It is an arithmetic constraint. The deeper the catalog, the shallower the review, by construction. You cannot solve a throughput problem with good intentions.

And the market has learned this. Rug pulls on tier-two venues follow a recognizable pattern: contract deploys with retained mint authority, it lists on a breadth venue within days, the venue's listing announcement functions as de facto endorsement to readers who will not read the contract, deployer mints into the demand, and the token dies. The venue's defense — 'we never said it was good' — is technically true and commercially hollow.

Which brings me back to the contradiction I opened with. If listing is a responsibility, then the responsibility must take a verifiable form. A published standard. A disclosed review checklist. A named review committee. A post-listing monitoring commitment with a stated delisting trigger.

None of that exists in the XT material. What exists is a slogan about responsibility and a disclaimer removing it. The verifiable form of responsibility is a standard, not a sentence. Everything else is tone.

The custody silence

Now the part that actually keeps me awake.

XT is a centralized exchange. That means users do not hold assets. Users hold a database entry, and the exchange holds the private keys. This is not a detail of the architecture. It is the architecture. Every other property of the platform — the matching engine, the UI, the listing breadth, the mobile app — sits on top of a single trust assumption: that the venue's key management, treasury operations, and withdrawal controls are what they claim to be.

Post-FTX, the industry converged on a standard answer to that assumption: proof of reserves via Merkle tree attestation, refreshed on a schedule, published as a root hash that users can verify their leaf against. It is imperfect. It proves liabilities and solvency at a point in time but says nothing about off-book leverage. Still, by 2023 every major venue published one — Binance, OKX, Bitget, Gate, and a dozen others. It became table stakes.

XT's campaign document, in all of its material on trust, transparency, and clarity, does not mention reserves once.

I want to be careful here, because I am reasoning from absence and absence is weak evidence. But in a promotional document, absence of a favorable fact is not neutral — it is informative. Marketing copy is the most optimized text a company produces. Every sentence is chosen. If a Merkle root existed, the sentence 'verified reserves, updated daily, verifiable by you' would be in the first three paragraphs, because it is the single most valuable sentence a CEX can write after FTX.

Silence on reserves in a document that uses the word 'Trust' as its brand anchor is the loudest thing in the file.

I know this from the inside. In November 2022, when FTX went from 'solvent' to 'insolvent' in about seventy-two hours, I moved $2.5 million into self-custody hardware wallets. It took me two days and I lost money on the transfers — fees, spreads, the operational friction of moving across chains on congested blocks. I did not care. I also shorted USDT during its brief depeg that same month and made roughly $300,000, because the market was pricing a stablecoin at a discount to its peg and I trusted the price signal more than I trusted anybody's reassurance.

That month taught me the only rule that has never failed me: you do not get to verify a custodian's balance sheet, so you must verify their incentive to lie — and if you cannot do either, you must not let them hold your inventory.

The absence of a PoR program is not a scandal. It might simply mean they never built one. But combined with 200+ country coverage and no disclosed licenses, it establishes a pattern — a venue that operates at scale without publishing the artifacts that scale-venues publish. That pattern is the risk.

The Launchpad vacuum

The one place in the XT ecosystem where real capital changes hands is the Launchpad. Projects raise, users get allocations, tokens list, prices discover.

This is the section of the campaign document with the least information, and it is the section with the most money in it.

No number of historical projects. No aggregate raise. No average post-listing return. No breakdown rate. No vesting terms. No allocation methodology. No statement on whether the exchange takes an allocation for itself.

Now apply the marketing logic test. If a Launchpad has a strong track record — if the average project is up 3x at TGE and 60% of them hold above issue price at six months — that is the single most powerful marketing asset a tier-two exchange could possibly have, and it would be the headline. Its absence tells you something about the distribution of outcomes. When a headline metric is missing from a document that exists to persuade, the metric is almost certainly in the left tail.

There is a structural problem here that goes beyond disclosure. A Launchpad is, mechanically, a primary issuance venue. Users commit capital to a project before there is a liquid market, on the basis of a pitch, with the exchange as intermediary. That is the definition of a securities offering in most of the world's developed jurisdictions, and the exchange is not a neutral observer in it — it is the distribution channel and, typically, a compensated one.

The 'discovery is not recommendation' frame does a lot of work here too. If the exchange did not recommend the project, what exactly did the user pay for? Access. Access to an allocation that the exchange chose to make available. You cannot monetize selection while disclaiming the judgment that selection requires. That is not caution. That is a free option on other people's losses.

Panic sells, liquidity buys. During every Launchpad cycle I have watched since 2020, the money that makes the return is the money that was already positioned before the crowd arrived, and the crowd's exit liquidity is the retail buyer who read the exchange's announcement as a signal. The exchange takes fees on both sides and never has inventory at risk.

Governance by slogan

Let me catalogue what is disclosed about the organization.

One name: Arman Achmed, COO. No founder. No CTO. No head of risk. No head of listing. No board. No advisory committee. No investor list, at any round, in eight years of operation. No entity jurisdiction. No parent company structure.

For a startup at seed stage, this is normal. For a venue that has, by its own account, 12 million registered users across 200+ countries and holds custody of their assets, it is a governance profile that no institutional allocator would accept for thirty seconds.

I have sat through enough due diligence calls to know what the absence of a cap table and an entity chart means in practice. It means that if something goes wrong, there is no identified counterparty to pursue, no balance sheet to attach, no board to write to, no regulator with clear standing. The user's recourse is a support ticket.

And there is the disclosure posture on listing decisions themselves. The campaign proposes that listing announcements should read as 'the opening of a market, not a judgment on the project', and that risk information should be presented clearly at the point of listing. On its face, that is more responsible than the industry norm, which is to say nothing at all.

But read the two claims together. If you publish risk warnings while simultaneously establishing that your listing conveys no judgment, you have constructed a machine that extracts listing fees from projects, extracts trading fees from users, and assigns zero residual responsibility to itself for the outcome. The risk disclosure becomes an instrument of liability transfer rather than user protection. A disclaimer that appears next to a product you monetized is not transparency. It is a receipt-shredding service with good typography.

The genuinely responsible version of this idea exists and it is unglamorous: publish the listing criteria. Publish what you check. Publish what disqualifies a project. Publish the monitoring conditions that trigger review, and the review conditions that trigger delisting. Publish the number of projects rejected last quarter.

That last one is the killer metric. A venue that lists 160 assets a year and rejects 800 is running a filter. A venue that lists 160 and rejects 20 is running a turnstile. I would like to see the number. I do not expect to.

The regulatory vacuum, and why 200+ countries is a warning

The document states coverage of more than 200 countries and regions. It does not state a single license, registration, or regulatory status anywhere in the world.

In the 2017-2020 era, this was ordinary. Offshore entity, no licenses, geo-block the US, operate everywhere else. In 2026, it is a structural exposure, and it is getting worse on a schedule.

The EU's MiCA framework reached the end of its transition period at the end of 2024. After that point, providing crypto-asset services to EU residents requires CASP authorization. Venues without it must geo-block the bloc or exit. The UK has its own authorization regime. Hong Kong's VASP licensing is live and enforcement-oriented. Japan, Korea, Singapore, and Australia all maintain licensing or registration requirements with real teeth. The United States has moved from enforcement improvisation toward statutory frameworks with registration obligations.

Which means the honest read of '200+ countries' in 2026 is not 'global reach'. It is 'we serve jurisdictions we have not told you about, under a legal structure we have not disclosed, and some meaningful fraction of that reach is being closed by regulators on a rolling basis.'

That is not a strength signal. It is a business-continuity risk. The failure mode is not dramatic. It is a notice on the website one morning saying services are no longer available in your region, followed by a withdrawal window, followed by friction. Ask anyone who held assets on a venue that lost US market access in a hurry how much fun that week was.

Now add the two business lines the campaign is proudest of: an RWA market and 'TradFi exposure'.

Tokenized real-world assets are securities in essentially every developed legal framework, or they are commodities, or they are derivatives — but they are never nothing. Offering them to the public without an appropriate license is not a grey area; it is the specific activity that securities regulators exist to regulate. And 'TradFi exposure' — if that means tokenized equity, FX, or index products — involves an even more heavily licensed activity set. Brokers need broker licenses. Derivatives venues need derivatives licenses.

A venue with no disclosed licenses in any jurisdiction, operating a tokenized-RWA market and a TradFi exposure product, is not innovating at the edge of the regulatory perimeter. It is standing in the middle of it wearing a costume.

I am not making a moral argument. I am making a counterparty argument. Regulatory action is a business risk that falls on users first: frozen withdrawals during an investigation, restricted access during a wind-down, asset recovery proceedings that take years and pay cents on the dollar. My 2022 lesson was not 'centralized exchanges are evil'. It was 'the cost of an exchange failure is borne by whoever is still holding a balance when the music stops.'

Metrics theater, and the competition nobody in the room will name

The campaign offers three numbers: 1,300+ tokens, 12 million users, 200+ countries.

Two of those three are not performance metrics, and the third one isn't defined.

'Registered users' is the most inflated number in the exchange industry. Registration requires an email and a password. It requires no deposit, no trade, no KYC in many cases. Industry norms put monthly active users at somewhere between five and ten percent of registered accounts for a venue of this type, and that ratio compresses as the registered base grows. Binance's registered-user figure is famously enormous in a way that has never once corresponded to a comparable active-user figure. A venue that chooses 'registered' as its headline number is choosing it because the alternative is smaller.

Active users, deposit volume, trading volume excluding wash, revenue, and reserve composition are the metrics that would actually tell a user whether this is a functioning business or a rented brand. None are disclosed.

'200+ countries' is not a metric at all. It is a distribution claim that, as I argued above, doubles as a regulatory exposure statement.

And 1,300 tokens is a catalog size. Catalogs are easy. Any venue can list a token in an afternoon. The hard part — the part that constitutes a moat — is having enough depth in a market that a real size can trade without moving the price, and having enough regulatory standing that an institution can touch it. XT has published nothing about either.

On competition: the campaign positions its breadth as a differentiated stance. It isn't. Gate.io has been running the breadth play since 2013, with more pairs and a longer track record. MEXC has run the speed play aggressively enough to own the 'first listing' identity. Binance and Coinbase own depth and compliance. XT is a third entrant into an occupied position, and its attempted escape — RWA, TradFi, payments, Launchpad, all at once — is the classic signature of a venue that has not found its wedge. Diversifying into five adjacent businesses is what you do when the core business has no defensible edge. It doesn't create one. It just spreads the same thin capital across more surfaces.

Every additional product line is another compliance regime, another audit surface, another team, another incident-response plan. For a tier-two venue with undisclosed funding, that is not expansion. That is dilution with extra steps.

What is actually true in the document

Let me be fair, because an audit that only finds faults is a bad audit.

Three things in the XT material are correct and worth stating plainly.

First, the attention-scarcity diagnosis is right. We are not in a discovery-rich market. We are in a market where the binding constraint on a new asset is whether anyone will look at it, and where the cost of looking has collapsed while the supply of things to look at has exploded. That is a genuine structural change and most exchange marketing still talks as if we were in 2021.

Second, the argument that new tokens are created without friction, so the constraint has moved from issuance to visibility, is mechanically accurate. Deployment is free. Distribution is not.

Third, the proposal to publish risk information at the point of listing is better than the industry default of publishing nothing. If XT actually does this — actually surfaces contract risk, unlock schedules, holder concentration, liquidity depth at the point of listing — it will be ahead of most of its competitors, and I will say so.

The problem is that all three of these are framings, not artifacts. Framings can be written by a copywriter in an afternoon. Artifacts require operations. And the document contains zero artifacts.

Contrarian

Now let me argue with myself, because the easy version of this piece is a hit job and I don't write those.

Here is the strongest case against my own analysis: the absence of disclosure is not evidence of misconduct. It is evidence of a marketing document written by a marketing team.

That is a real point. I have been treating a promotional campaign as if it were a due-diligence pack, and those are different genres. Nobody publishes their license numbers in an ad. Coinbase's ads don't cite their reserve attestation either. I am, in a sense, criticizing a fish for not climbing.

Fair. So let me restate the actual claim, more narrowly. I am not saying XT is insolvent, unlicensed, or fraudulent. I am saying the document provides no basis to conclude otherwise, and that a venue with 12 million registered users and custody of their assets has an obligation — not a marketing choice — to provide that basis somewhere. If it exists somewhere else, say so, and I will update. Until then, the default posture toward an unverified custodian is not trust. It is sizing.

Second contrary point, and this one bites harder: 'just list fewer coins' is not actionable advice for a tier-two exchange.

Think about the business. XT cannot win depth on Bitcoin — the top venues have it and the marginal dollar of liquidity flows to where the spread is tightest. XT cannot win compliance — that takes years and licenses it does not have. What a tier-two venue has is the ability to serve demand that tier-one venues refuse to serve: the new token, the weird token, the token from a jurisdiction Binance won't touch, the token that hasn't been listed anywhere yet. That is a real business, and it serves a real function, and the people who use it are not all idiots.

The long tail exists because someone wants to trade it. Telling XT to stop listing the tail is telling it to stop existing. And the alternative — 'list fewer, better coins' — is a strategy that sounds wise and produces a venue that is neither deep enough to compete with Binance nor broad enough to compete with Gate. There is a graveyard of exchanges that tried to be picky without being big.

So the problem isn't breadth. The problem is breadth without publishing the machinery of breadth. A venue can list 1,300 tokens responsibly if it publishes its contract-screening checklist, its delisting triggers, and its post-listing monitoring cadence. That is the responsible version of the business model, and it is available to XT today, at the cost of one engineering sprint and one legal review.

The fact that it hasn't done this is not a business-model inevitability. It is a choice.

Third contrarian point: maybe 'discovery is not recommendation' is the most honest sentence in the document.

Consider the alternative. If a listing is a recommendation, then the exchange is an investment adviser, and every listed token becomes a security the exchange has endorsed, and the exchange's liability for a rug becomes existential. No exchange can operate under that standard. Binance doesn't. Coinbase doesn't — it lists assets its own research team dislikes.

So XT's position — we open markets, we do not rate projects — is the only coherent position available to a listing venue. And in a market where retail traders persistently treat listings as endorsements, saying so explicitly is arguably a public service.

The failure is not the disclaimer. The failure is the combination: disclaiming judgment while refusing to publish the objective screening criteria that substitute for it. There is a version of this that works. Publish the checklist, publish the rejections, publish the monitoring triggers, and then say 'a listing is not a recommendation.' At that point the sentence is honest, because you have shown the reader exactly what you checked and exactly what you didn't. Without the checklist, the sentence is just a shield.

One more thing, and it is the thing I keep coming back to. Every rhetorical move in this campaign points the same direction: it uses the vocabulary of transparency — trust, clarity, responsibility, discovery — to create the impression that disclosure has occurred, while the disclosures themselves are absent. That is a specific technique, and it is more dangerous than silence, because a reader who skims the document comes away believing they have been told something.

I have seen this pattern before, in whitepapers. In 2017 I read dozens of them, and the ones that failed weren't the ones that made modest claims. They were the ones that used the language of rigor — 'audited', 'verified', 'mathematically proven' — while citing an audit that didn't exist. The tell is always the same: vocabulary is cheap, artifacts are expensive, and the ratio between them is the whole game.

Code doesn't care about your feelings. Neither does an auditor. You either have the report or you don't.

Takeaway

So what do you actually do with this, if you are a trader and not a regulator?

You price it. Not the token — the venue risk.

Treat XT as what it verifiably is: a broad, functioning, tier-two order book venue with real operating history and real listing cadence, sitting on an unverified custody model, an undisclosed regulatory posture, and a governance structure that reduces to one named executive. Size your exposure to that, and size it small. Not because the venue is bad — because the venue is unknown, and unknown counterparties get small allocations.

Operationally: never leave inventory on a venue you have not stress-tested for withdrawal. Keep the working balance to what you would tolerate losing in a 72-hour freeze. If you trade the long tail, check the contract permissions yourself before you enter — mint authority, blacklist, pause, upgradeability — because the listing venue will not have done it for you at three listings a week. And when you see a listing announcement, read the price action in the first hour as a liquidity event, not an information event; thin books move for reasons that have nothing to do with the asset.

The forward-looking question, and the one I would put to XT's COO directly if I had the room: if a listing is not a judgment, what is the number of projects you rejected last quarter?

That single number would tell me more about whether this is a filter or a turnstile than the entire campaign document. It is the kind of disclosure that costs nothing to publish and means everything. Its absence is the entire argument.

Yield is the bait, rug is the hook. The bait here is 1,300 assets and a story about discovery. The hook is that you were never shown the reserves, the licenses, or the standard — and you were told a listing announcement is not a judgment, so you should not ask for one.

Panic sells, liquidity buys. And the thing about a market with no depth is that it doesn't need a panic. It just needs one seller.