Verify a decision

{"actor":"system:backfill","investigation_id":"327d806e-1bc9-4557-8157-b7606f7e8949","kind":"publish","page_slug":"edel-finance","published_at":"2026-07-01T17:03:45.725Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Edel Finance","sections":[{"content":"On July 1, 2026, an attacker executed a flash-loan-assisted exchange-rate manipulation attack against Edel Finance's V1 lending contracts, draining approximately $403,000 from the protocol's xStock lending reserves. The vulnerability did not originate from Chainlink price feeds, which correctly reported Alphabet's share price at approximately $357. Instead, the attacker exploited the wrapping mechanism governing the conversion between GOOGLx (a tokenized Google stock token) and wGOOGLx (its wrapped form). By using a flash loan to temporarily inflate the wGOOGLx/GOOGLx exchange rate, the attacker caused the collateral value of wGOOGLx to be reported at approximately 78 times its true market value — a 7,700% inflation. Borrowing against this phantom collateral, the attacker extracted real assets from the lending reserves. Custom exploit contracts were deployed specifically for this attack. According to on-chain data cited by multiple outlets, the attacker's wallet (0x584...11C76) received the drained funds and subsequently routed the entire amount to Tornado Cash, the sanctioned cryptocurrency mixing protocol, severely complicating recovery. Total value locked collapsed from approximately $630,000 to roughly $947 within hours as users mass-withdrew upon discovery of the exploit, representing near-total user flight. DeFiLlama recorded net outflows of approximately $630,000 on the day of the incident.","heading":"July 1, 2026 Flash-Loan Oracle Manipulation Exploit","severity":"critical","sources":[{"credibility":1,"name":"Prices of tokenized Google stock inflated 7,700% in rare DeFi lending exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/01/tokenized-google-stock-inflated-7-700-in-rare-defi-lending-exploit"},{"credibility":2,"name":"Edel Finance Hacked: $403K Stolen as Attacker Moves Funds to Tornado Cash","type":"news_article","url":"https://www.cryptotimes.io/2026/07/01/edel-finance-hacked-403k-stolen-as-attacker-moves-funds-to-tornado-cash/"},{"credibility":2,"name":"Edel Finance loses $403K as flash-loan oracle exploit hits xStock lending reserves","type":"news_article","url":"https://ambcrypto.com/edel-finance-loses-403k-as-flash-loan-oracle-exploit-hits-xstock-lending-reserves/"},{"credibility":2,"name":"Edel Finance Exploit Exposes Oracle Weakness, Leaves $403K Hole","type":"news_article","url":"https://www.livebitcoinnews.com/edel-finance-exploit-exposes-oracle-weakness-leaves-403k-hole/"},{"credibility":2,"name":"Edel Pauses Lending Platform after Exploit Leaves Protocol with $403,000 Loss","type":"news_article","url":"https://defi-planet.com/2026/07/edel-pauses-lending-platform-after-exploit-leaves-protocol-with-403000-loss/"}]},{"content":"All stolen funds — approximately $403,000 — were routed to Tornado Cash, the sanctioned cryptocurrency mixing protocol, within hours of the exploit. Tornado Cash has been sanctioned by the U.S. Office of Foreign Assets Control (OFAC) since August 2022. The use of Tornado Cash by the attacker severely complicates tracing and recovery efforts. Edel Finance stated it is coordinating with ecosystem partners and centralized exchanges to attempt to trace the funds. The team extended a formal whitehat settlement offer, providing the attacker a defined window to return funds in exchange for an authorized security bounty. As of the date of this filing, no return of funds has been publicly confirmed. Recovery prospects are considered limited given the use of a sanctioned mixing service.","heading":"Tornado Cash Fund Routing and Recovery Prospects","severity":"critical","sources":[{"credibility":2,"name":"Edel Finance Hacked: $403K Stolen as Attacker Moves Funds to Tornado Cash","type":"news_article","url":"https://www.cryptotimes.io/2026/07/01/edel-finance-hacked-403k-stolen-as-attacker-moves-funds-to-tornado-cash/"},{"credibility":2,"name":"Edel Finance Exploit Exposes Oracle Weakness, Leaves $403K Hole","type":"news_article","url":"https://www.livebitcoinnews.com/edel-finance-exploit-exposes-oracle-weakness-leaves-403k-hole/"}]},{"content":"Edel Finance stated it identified and contained the exploit on July 1, 2026, the same day it occurred. The team immediately paused all V1 contracts, which remained offline as of the time of filing. The protocol committed to absorbing all bad debt directly and restoring affected depositor balances at a 1:1 ratio, meaning depositors are not expected to bear losses. No firm timeline was provided for the restoration process. Edel announced it is developing a V2 deployment featuring a redesigned oracle and pricing architecture specifically intended to address the exchange-rate manipulation vector exploited in the attack. The team stated it is coordinating with exchanges to trace the attacker's transactions. No independent post-mortem or technical audit report had been publicly released as of filing.","heading":"Protocol Response and V2 Remediation Plans","severity":"high","sources":[{"credibility":1,"name":"Prices of tokenized Google stock inflated 7,700% in rare DeFi lending exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/01/tokenized-google-stock-inflated-7-700-in-rare-defi-lending-exploit"},{"credibility":2,"name":"Edel Finance loses $403K as flash-loan oracle exploit hits xStock lending reserves","type":"news_article","url":"https://ambcrypto.com/edel-finance-loses-403k-as-flash-loan-oracle-exploit-hits-xstock-lending-reserves/"},{"credibility":2,"name":"Edel Pauses Lending Platform after Exploit Leaves Protocol with $403,000 Loss","type":"news_article","url":"https://defi-planet.com/2026/07/edel-pauses-lending-platform-after-exploit-leaves-protocol-with-403000-loss/"}]},{"content":"Edel Finance's V1 lending contracts are a fork of Aave v3. The GitHub repository for the protocol allegedly includes inherited Aave audit PDFs from firms including OpenZeppelin, Trail of Bits, PeckShield, and SigmaPrime. However, no independently commissioned, published third-party audit of Edel Finance's own deployment and modifications has been publicly confirmed. Inheriting audits from the upstream Aave codebase does not cover protocol-specific customizations, including the wGOOGLx wrapping mechanism that was the vector for the July 2026 exploit. The July 1 attack has been characterized by security researchers as consistent with oracle price manipulation patterns, which OWASP ranked second in its 2025 Smart Contract Top 10 vulnerabilities. The absence of a dedicated audit covering Edel's bespoke equity-wrapping mechanisms represents a material prior risk factor.","heading":"Audit Status and Security Architecture","severity":"high","sources":[{"credibility":1,"name":"Prices of tokenized Google stock inflated 7,700% in rare DeFi lending exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/01/tokenized-google-stock-inflated-7-700-in-rare-defi-lending-exploit"},{"credibility":2,"name":"Edel Finance founder team CEO blockchain network audit (search results)","type":"news_article","url":"https://www.cryptopolitan.com/edel-finance-wallets-snipe-token-supply/"}]},{"content":"In November 2025, blockchain analytics platform Bubblemaps alleged that Edel Finance's internal team coordinated the acquisition of more than 30% of the total EDEL token supply — valued at approximately $11 million at the time — through approximately 160 wallets during the token's launch. The stated team allocation in published tokenomics was 12.7% of supply. Bubblemaps alleged the wallets used obfuscation techniques consistent with automated sniping bots, funded through Binance and MEXC, and that secondary wallets used the same obfuscation method. Co-founder James Sherborne disputed the framing, stating the team had acquired approximately 60% of supply and placed the tokens into a vesting contract with a six-month cliff, characterizing this as disclosed planned allocation. Critics noted the plan had not been publicly announced in advance and that the execution contradicted the published tokenomics document. The EDEL token declined approximately 62% in market capitalization to $14.9 million within a week of the allegations surfacing. The EDEL token also fell 16.3% on the day of initial reporting.","heading":"November 2025 Token Allocation Controversy","severity":"high","sources":[{"credibility":2,"name":"Edel Finance-linked wallets 'snipe' 30% of token supply, co-founder denies allegations","type":"news_article","url":"https://www.cryptopolitan.com/edel-finance-wallets-snipe-token-supply/"},{"credibility":2,"name":"Shocking Edel Finance Token Controversy: Insiders Acquire 30% Despite Fair Launch Promise","type":"news_article","url":"https://cryptorank.io/news/feed/ec441-edel-finance-token-controversy"}]},{"content":"Edel Finance describes itself as a programmable credit market layer for tokenized equities and real-world assets, enabling lending and borrowing against tokenized stocks sourced from providers including Ondo Finance. The protocol's V1 lending contracts are built on the Base/EVM network as an Aave v3 fork, with the EDEL governance token trading on Base. An institutional component, Edel Markets, is a Canton Network-based privacy-preserving perpetual-futures exchange for equities and commodities, with a stated Q3 2026 target launch date. The lending mainnet launched on March 25, 2026, following a testnet phase on Robinhood Chain that reportedly attracted over 90,000 users. Co-founders include Andrés Soltermann (CEO) and James Sherborne. The team includes staff with backgrounds from State Street, JPMorgan, and Airbnb. Brad Klaas, BlackRock's former Global Head of Securities Lending, joined the protocol's advisory board, as reported in June 2026. The protocol was launched from Singapore, per published reporting.","heading":"Protocol Background and Team","severity":"low","sources":[{"credibility":2,"name":"What Is Edel (EDEL) And How Does It Work? — CoinMarketCap","type":"other","url":"https://coinmarketcap.com/cmc-ai/edel/what-is/"},{"credibility":2,"name":"Edel's Mainnet Arrival Signals a New Credit Layer for Tokenized Equities — Decrypt","type":"news_article","url":"https://decrypt.co/362309/edels-mainnet-arrival-signals-a-new-credit-layer-for-tokenized-equities"},{"credibility":2,"name":"Unleash Earnings: Discover the Power of Edel Tokenized Stock Lending — Phemex","type":"other","url":"https://phemex.com/academy/what-is-edel-tokenized-stock-lending"},{"credibility":3,"name":"Edel Launches Mainnet, Unlocking Direct Credit from Tokenized Equities","type":"other","url":"https://news.marketersmedia.com/edel-launches-mainnet-unlocking-direct-credit-from-tokenized-equities-as-dollaredel-debuts-on-weex/89186751"},{"credibility":3,"name":"Edel Finance — Canton Network DeFi 2026","type":"other","url":"https://canton.wiki/projects/edel-finance"}]}],"sources_used":[{"credibility":1,"name":"Prices of tokenized Google stock inflated 7,700% in rare DeFi lending exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/01/tokenized-google-stock-inflated-7-700-in-rare-defi-lending-exploit"},{"credibility":2,"name":"Edel Finance Hacked: $403K Stolen as Attacker Moves Funds to Tornado Cash","type":"news_article","url":"https://www.cryptotimes.io/2026/07/01/edel-finance-hacked-403k-stolen-as-attacker-moves-funds-to-tornado-cash/"},{"credibility":2,"name":"Edel Finance loses $403K as flash-loan oracle exploit hits xStock lending reserves","type":"news_article","url":"https://ambcrypto.com/edel-finance-loses-403k-as-flash-loan-oracle-exploit-hits-xstock-lending-reserves/"},{"credibility":2,"name":"Edel Pauses Lending Platform after Exploit Leaves Protocol with $403,000 Loss","type":"news_article","url":"https://defi-planet.com/2026/07/edel-pauses-lending-platform-after-exploit-leaves-protocol-with-403000-loss/"},{"credibility":2,"name":"Edel Finance Exploit Exposes Oracle Weakness, Leaves $403K Hole","type":"news_article","url":"https://www.livebitcoinnews.com/edel-finance-exploit-exposes-oracle-weakness-leaves-403k-hole/"},{"credibility":2,"name":"Edel Finance Loses $403K in Flash-Loan Oracle Exploit — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/edel-finance-loses-403k-in-flash-loan-oracle-exploit"},{"credibility":2,"name":"Edel Finance-linked wallets 'snipe' 30% of token supply, co-founder denies allegations","type":"news_article","url":"https://www.cryptopolitan.com/edel-finance-wallets-snipe-token-supply/"},{"credibility":2,"name":"Shocking Edel Finance Token Controversy: Insiders Acquire 30% Despite Fair Launch Promise","type":"news_article","url":"https://cryptorank.io/news/feed/ec441-edel-finance-token-controversy"},{"credibility":2,"name":"Edel's Mainnet Arrival Signals a New Credit Layer for Tokenized Equities — Decrypt","type":"news_article","url":"https://decrypt.co/362309/edels-mainnet-arrival-signals-a-new-credit-layer-for-tokenized-equities"},{"credibility":2,"name":"What Is Edel (EDEL) And How Does It Work? — CoinMarketCap","type":"other","url":"https://coinmarketcap.com/cmc-ai/edel/what-is/"},{"credibility":2,"name":"Unleash Earnings: Discover the Power of Edel Tokenized Stock Lending — Phemex","type":"other","url":"https://phemex.com/academy/what-is-edel-tokenized-stock-lending"},{"credibility":3,"name":"Edel Launches Mainnet, Unlocking Direct Credit from Tokenized Equities","type":"other","url":"https://news.marketersmedia.com/edel-launches-mainnet-unlocking-direct-credit-from-tokenized-equities-as-dollaredel-debuts-on-weex/89186751"},{"credibility":3,"name":"Edel Finance — Canton Network DeFi 2026","type":"other","url":"https://canton.wiki/projects/edel-finance"}],"summary":"Edel Finance is a decentralized lending protocol for tokenized equities, built as an Aave v3 fork on the Base/EVM network with an institutional Canton Network component, that launched mainnet on March 25, 2026. On July 1, 2026, the protocol suffered a flash-loan oracle manipulation exploit that drained approximately $403,000 from its xStock lending reserves, with stolen funds routed immediately to Tornado Cash. The protocol had also faced prior controversy in November 2025 over alleged insider acquisition of more than 30% of the EDEL token supply, contradicting stated tokenomics.","timeline":[{"date":"2025-11-01","event":"EDEL governance token launched; Bubblemaps later alleged coordinated insider acquisition of over 30% of total supply, contradicting the stated 12.7% team allocation.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/edel-finance-wallets-snipe-token-supply/"},{"date":"2025-11-25","event":"Bubblemaps published blockchain analysis alleging insider sniping of the EDEL token supply; co-founder James Sherborne issued a rebuttal. EDEL token declined approximately 62% in market cap within a week.","source":"Cryptopolitan / CryptoRank","source_url":"https://www.cryptopolitan.com/edel-finance-wallets-snipe-token-supply/"},{"date":"2026-03-25","event":"Edel Finance V1 lending mainnet launched on EVM/Base, with Aave v3 fork contracts supporting tokenized equity lending and borrowing.","source":"Decrypt","source_url":"https://decrypt.co/362309/edels-mainnet-arrival-signals-a-new-credit-layer-for-tokenized-equities"},{"date":"2026-06-03","event":"Brad Klaas, BlackRock's former Global Head of Securities Lending, announced as Edel Finance advisory board member.","source":"TechTimes","source_url":"https://www.techtimes.com/articles/317682/20260603/blackrocks-former-securities-lending-chief-joins-edel-finance-chain-capital-market-takes-shape.htm"},{"date":"2026-07-01","event":"Flash-loan oracle manipulation exploit drains approximately $403,000 from Edel Finance V1 xStock lending reserves. Attacker inflated wGOOGLx/GOOGLx exchange rate by approximately 7,700% (78x actual value), borrowed against phantom collateral, and routed all funds to Tornado Cash. TVL collapsed from approximately $630,000 to roughly $947.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/07/01/tokenized-google-stock-inflated-7-700-in-rare-defi-lending-exploit"},{"date":"2026-07-01","event":"Edel Finance paused all V1 contracts, committed to absorbing $403,000 bad debt at 1:1 for depositors, extended whitehat settlement offer to attacker, and announced V2 development with redesigned oracle architecture.","source":"AMBCrypto / DeFi Planet","source_url":"https://ambcrypto.com/edel-finance-loses-403k-as-flash-loan-oracle-exploit-hits-xstock-lending-reserves/"}]},"v":1}