Flash loan inflates tokenized Google collateral 78×

Edel, a decentralized finance lending protocol, disclosed an exploit in which a flash loan attacker manipulated the exchange rate between wGOOGLx, a wrapped version of Edel’s tokenized Google stock, and GOOGLx. The manipulation inflated the wrapped token’s collateral value roughly 78 times. Security firms estimate losses between $204,000 and $403,000. Alphabet’s share price did not change during the incident.

The attacker used a flash loan to repeatedly supply and borrow on the platform, driving the wGOOGLx/GOOGLx conversion rate out of alignment. Edel’s price source read a vault conversion value through latestAnswer() to return an ERC-4626-style convertToAssets() rate. When an actor controls enough of the underlying asset flow, that conversion rate can be moved; the distorted exchange rate was then used by Edel’s lending market to value collateral and underwrite loans.

Security firms reported different loss figures. GoPlus put losses at about $403,000 and estimated roughly $305,000 in attacker profit. Cyvers estimated losses near $353,000. CertiK reported roughly $204,000 drained. The discrepancy reflects different measurements, including gross funds removed, outstanding bad debt on the protocol, or net attacker gains. Reported borrowed assets included 384,215 USDC and wrapped positions in SPYx, QQQx, MSTRx, NVDAx and TSLAx.

Edel committed to absorbing the bad debt, restoring affected user balances one-for-one and rebuilding the protocol’s oracle architecture in a version two release. Auditors and security firms traced the root cause to the way the protocol read a vault’s conversion rate and characterized the failure as an exchange-rate and oracle issue between a wrapped token and its on-chain underlying, not a movement in Alphabet’s market price.

Tokenized equities have grown on-chain; one tracker estimates about $1.7 billion in tokenized stocks. Providers list more than 100 stock and ETF tokens across multiple integrations, and several lending and infrastructure projects accept these tokens as collateral. Robinhood launched stock and ETF tokens for EU customers in June 2025 and opened a public testnet for a tokenized-asset chain. Some lending protocols accept tickers such as SPYx, QQQx, GOOGLx, AAPLx, NVDAx, TSLAx and MSTRx for borrowing and yield.

Auditors warned that using wrapped-token exchange rates directly in price feeds creates an attack surface that a single large transaction, such as a flash loan, can move. Edel’s stated plan to restore balances and redesign how it handles oracles and wrappers addresses the specific failure modes identified by auditors.