Edel Finance lending market drained of $403K in oracle exploit
Security & Exploits ·
An Aave-fork protocol accepting tokenized stock collateral lost roughly $403K after an attacker manipulated the exchange-rate oracle for its wrapped xStock vaults.
Edel Finance, an Aave-fork lending market on Ethereum, was exploited on 2026-07-01 for a loss of about $403K. The protocol accepts wrapped xStock tokens, including wGOOGLx, as collateral, pricing them off the wrapper's ERC-4626 share-to-asset rate rather than an independent feed. That convertToAssets calculation, which derives value from underlying balance divided by total supply, proved manipulable.
The attacker flash-loaned 180K USDC and executed a 41x supply-and-borrow loop against the vault, skewing the share ratio and inflating the reported wGOOGLx price to roughly $28k against a real value near $180. With collateral valued far above its actual worth, the attacker was able to borrow out most of the pool's holdings — 204K USDC alongside tokenized stock positions in wSPYx, wQQQx, wMSTRx, wNVDAx and wTSLAx — extracting close to $403K and emptying most of the pool's roughly $602K total value locked. The affected contract is recorded on Etherscan.
The incident lands in a period of broader turbulence for Ethereum-linked activity. Taiko's layer 2 network has been working through recovery from a separate exploit, reopening its bridge as restoration progresses toward a post-mortem release. On the institutional side, Ethereum Institutional, a non-profit founded by former Ethereum Foundation members, launched to support institutional adoption, while Robinhood brought its Arbitrum-based layer 2 to public mainnet with tokenized stock trading — a product category adjacent to the wrapped-stock collateral model that Edel Finance's exploit exposed. Market data from Santiment meanwhile showed SOL open interest hitting a five-month high even as BTC and ETH held flat.
The exploit also arrives as ETH trades through a third consecutive quarterly loss, sitting near $1,560, with analyst projections ranging from $1,000 to $1,300 to the downside, though an oversold RSI reading and thinning exchange reserves have been flagged as potential signals of a rebound.
What remains unresolved is whether Edel Finance will attempt any recovery of funds or compensate affected depositors, and whether other protocols relying on ERC-4626 share-rate oracles for illiquid or thinly traded wrapped assets carry similar exposure. The attacker and victim contract addresses are now under public scrutiny, but no statement from the Edel Finance team had been referenced at the time of reporting, leaving the scope of any remediation plan an open question.