Edel exploit shows tokenized stocks can fail before shares move

For crypto investors watching tokenized equities move deeper into DeFi, Edel's latest exploit is a reminder that collateral can fail even when the underlying stock does not. The issue was not Alphabet's share price. It was how a wrapped stock token was priced inside a lending market.

Edel said an attacker manipulated the exchange rate between wGOOGLx and GOOGLx, its tokenized Google stock wrapper and underlying token. That pushed wGOOGLx's collateral value to about 78 times its real level, letting the attacker borrow against inflated collateral. Borrowed assets included 384,215 USDC plus wrapped positions tied to SPYx, QQQx, MSTRx, NVDAx, and TSLAx.

Security firms described the same basic path. SlowMist said Edel's oracle used an ERC-4626-style convertToAssets() rate through latestAnswer(), which could be distorted if an attacker controlled enough flow. GoPlus said a flash loan was used to repeatedly supply and borrow, skewing the conversion rate. CertiK said the lending market then accepted that inflated value.

Loss estimates ranged from about $204,000 to $403,000, likely because firms measured different things such as bad debt, gross loss, or attacker profit. Edel said depositors will not take losses, the team will cover the bad debt, restore balances one-to-one, and rebuild the oracle design for a v2 release.