Edel's $403K exploit exposes tokenized-stock pricing flaw
In brief
- Edel exploit: wGOOGLx/GOOGLx exchange rate manipulated to inflate collateral value to 78x correct level.
- Attacker used flash loan to borrow 384,215 USDC and wrapped positions in SPYx, QQQx, and other tokenized stocks.
- Root cause: Edel's oracle used latestAnswer() on ERC-4626 vault's convertToAssets() rate, exploitable when attacker controls flow.
- Tokenized stocks hold $1.7B onchain value; DeFi protocols must price equity, wrapped token, conversion rate, oracle path, and lending limits.
The Attack and the Layers
DeFi lending protocol Edel disclosed a $403,000 exploit affecting tokenized stocks used as collateral. The attack manipulated the exchange rate between wGOOGLx and GOOGLx, pushing wGOOGLx's collateral value to roughly 78 times its correct level.
SlowMist traced the root cause to Edel's price source using latestAnswer() to return an ERC-4626-style vault's convertToAssets() rate, which can be manipulated when an attacker controls enough of the underlying flow. The attacker used a flash loan to repeatedly supply and borrow, distorting the wGOOGLx/GOOGLx conversion rate and supporting borrowed assets including 384,215 USDC and wrapped positions in SPYx, QQQx, MSTRx, NVDAx, and TSLAx.
Security firms published different loss estimates. Cyvers put the loss at roughly $353,000, GoPlus cited about $403,000 in losses and roughly $305,000 in attacker profit, and CertiK put the drained funds at roughly $204,000. Edel said no depositor would bear losses and the team would absorb the bad debt and restore affected balances one-to-one.
Why Tokenized Stocks Add Complexity
The critical failure sat in the exchange rate between the wrapped token and its underlying counterpart, a relationship that Edel's lending market priced as though it were stable, not driven by Alphabet's share price. A lending market prices several layers: the tokenized equity itself, the wrapped version built on top of it, the exchange rate a vault uses to convert between the two, the oracle path that reports a value, and the lending market's own borrowing limits.
The problem isn't new to DeFi. But tokenized stocks amplify it. Backed, the issuer behind xStocks, markets the tokens explicitly for DeFi use such as lending tokenized Apple shares or borrowing against them without selling. Kamino became the first major lending protocol to accept tokenized equities as collateral, allowing users to deposit tokens such as SPYx, QQQx, GOOGLx, AAPLx, NVDAx, TSLAx, MSTRx, and HOODx to borrow stablecoins or earn yield.
The Market Grows
RWA.xyz puts tokenized stocks' onchain value at $1.7 billion, up 2.17% over the past 30 days, with monthly transfer volume of $8.92 billion and holders over 396,000. xStocks alone lists more than 100 stocks and ETFs across more than 50 integrated platforms, with over $25 billion in total transaction volume.
Robinhood launched stock and ETF tokens for EU customers in June 2025, then opened a public testnet for Robinhood Chain, an Ethereum layer-2 built on Arbitrum designed around tokenized real-world assets. The infrastructure is expanding. But Edel's exploit shows the pricing layers aren't yet hardened. Protocols building on this tech need to audit not just the equity price feed, but every intermediate conversion that happens between the real asset and the lending market that accepts it.
