Edel, a DeFi lending protocol, disclosed a $403,000 exploit that affected the layer where tokenized stocks are used as collateral. The attack manipulated the exchange rate between the wrapped Google stock token wGOOGLx and its underlying GOOGLx token, inflating wGOOGLx's collateral value to roughly 78 times its correct level. By using a flash loan to repeatedly supply and borrow, the attacker distorted the price feed that relied on an ERC‑4626 vault conversion rate, enabling the borrowing of about 384,215 USDC and positions in wrapped SPY, QQQ, MSTR, NVDA and TSLA tokens.

The protocol said no depositor would bear losses and that it would absorb the bad debt, restore affected balances one‑to‑one, and rebuild its oracle architecture for a version two release. Security firms reported differing loss amounts: Cyvers estimated the loss at $353,000, GoPlus at $403,000 with about $305,000 in attacker profit, and CertiK at $204,000, reflecting variations in how bad debt, gross loss and net profit were measured.

Tokenized stocks currently have an on‑chain value of $1.7 billion, up 2.17 % in the past 30 days, with monthly transfer volume of $8.92 billion and over 396,000 holders. Platforms such as Kamino have become the first major lenders to accept these tokens as collateral, while Robinhood plans to launch tokenized stock tokens for EU customers on an Ethereum layer‑2 built on Arbitrum.

The incident underscores the need for protocols to isolate wrapper risk, cap collateral exposure, separate issuer prices from exchange rates and harden oracle paths, lest tokenized equities become vulnerable to flash‑loan attacks that can undermine their credibility as collateral.