Edel Finance, a tokenized equities trading platform, paused its lending protocol on Tuesday after an attacker exploited the wrapping mechanism of a tokenized Google stock, borrowing against collateral inflated to roughly 78 times its true value and leaving about $403,000 in bad debt, the team said.
The target was a tokenized version of Alphabet's Google stock. Edel Lending accepted wGOOGLx, a wrapped form of the tokenized share GOOGLx, as collateral. A wrapped token is meant to track the underlying asset one-to-one. The attacker manipulated the exchange rate between GOOGLx and wGOOGLx so that wGOOGLx was valued at about 78 times what it should have been, then used that phantom collateral to borrow real assets from the protocol.
The pricing oracle itself wasn't the weak point. Edel said it used Chainlink oracles, which were reporting the correct Google share price of around $357. The flaw sat in the wrapping mechanism: the attacker interfered with how GOOGLx converted to and from wGOOGLx, causing the collateral to be mispriced even though the underlying price feed was accurate.
Edel said it detected and contained the exploit, then paused all version-one contracts, which remain frozen, and warned users not to interact with them. The team added it had traced the attacker's transactions and is coordinating with exchanges, and has offered the attacker a whitehat settlement: a deal that lets a hacker return most of the funds in exchange for a fee and no legal pursuit, within a set window.
No depositor will take a loss, Edel noted, with the team absorbing the bad debt and restoring balances one for one. It is deploying a version two with a redesigned pricing setup meant to block this kind of manipulation, and promised a full technical breakdown to follow.
Small amount, but a persistent DeFi vulnerability
While the amount is small, the method sits in one of DeFi's most persistent exploit categories. Manipulating the price a protocol reads — rather than breaking into it — ranks as the second most common smart-contract vulnerability in the OWASP Smart Contract Top 10 for 2025. Security researchers at CertiK describe oracle price manipulation as one of the field's most common attack vectors.
Alongside cross-chain bridges, which produced the year's largest single thefts — including the $292 million drained from Kelp DAO in April — price manipulation is where a lot of the money keeps going. In most of these attacks, the code works as written; the problem is that external inputs are twisted. Tokenized equities extend that attack surface. Products that put stocks like Google onchain are among the fastest-growing parts of DeFi, and they add another layer between an asset and its price: the wrapping and conversion steps that turn a share into collateral.