A decentralized lending protocol was drained after an attacker pushed the price of a tokenized Google stock to roughly 7,700% above its real market value, then borrowed against the inflated collateral. CoinDesk reported the incident on July 1, 2026, describing it as a rare exploit that targeted the point where real-world asset (RWA) tokens meet onchain lending markets.
The mechanics are simpler than the headline number suggests. Lending markets let users deposit an asset as collateral and borrow other assets against it. The amount they can borrow depends on the collateral's price, which the protocol reads from a price feed, or oracle. If that price can be manipulated, the borrowing limit moves with it. Inflate the collateral's reported value, and you can walk away with far more than you put in.
The gap between a token and the thing it represents
A tokenized Google share is meant to track the price of the actual GOOGL equity trading on the Nasdaq. Google's stock did not swing 7,700% on July 1. The token's on-protocol price did, because the lending market was reading a thin or manipulable price source rather than a deep, well-guarded feed tied to the underlying equity.
That distinction sits at the center of the RWA trend. Issuers have spent the past year putting tokenized stocks and ETFs onchain, pitching 24/7 settlement and composability with DeFi. Composability is the selling point and the risk. The moment a tokenized share becomes collateral in a permissionless lending pool, its safety depends not just on the issuer's redemption promise but on every oracle and market the token touches downstream.
Thin liquidity makes this worse. A token that barely trades can have its market price shoved a long way with a small amount of capital. If a lending protocol trusts that manipulated price, the attacker mints borrowing power out of nothing. The 7,700% figure is not a claim about Google's business. It is a measure of how far a lightly traded token drifted from reality before anyone could stop it.
A pattern DeFi has seen before
Oracle manipulation is one of the oldest attack classes in decentralized finance. Protocols including Mango Markets and several smaller lending platforms have been drained the same way: move the price of a thinly traded collateral asset, borrow against the fake value, and leave the pool holding a bad debt. What is new here is the collateral type. This is one of the first high-profile cases where the manipulated asset was a tokenized version of a blue-chip stock rather than a native crypto token.
That matters because tokenized equities are being marketed as safer and more familiar than volatile altcoins. A share of Google feels stable. The wrapper around it may not be. An RWA token inherits the price behavior of its underlying asset only when the pricing infrastructure holds. Break the infrastructure and the "safe" collateral behaves like any other manipulable token.
For anyone tracking the direction of onchain equities, the incident is a data point about execution risk, not a verdict on the whole category. Tokenized stock trading has been growing fast, with Solana alone processing over $1B in weekly tokenized stock volume in June. Volume that size pulls tokenized shares into more lending pools, more leverage strategies, and more oracle dependencies, which widens the attack surface rather than shrinking it.
The connection to custody and counterparty risk
The exploit is a reminder that self-custody of a token does not equal safety of the system around it. Holding a tokenized share in your own wallet protects you from an issuer freezing your balance. It does not protect the lending pool you deposited it into from an oracle failure. These are separate risks, and RWA products stack both: issuer solvency and redemption on one side, onchain pricing and protocol design on the other.
The same logic applies to the broader move to bring institutional finance onchain, a theme running through recent launches aimed at institutional Ethereum adoption and tokenized funds. Every new bridge between traditional assets and permissionless DeFi adds convenience and a fresh dependency. The convenience is visible on day one. The dependency usually only shows up when it fails.
Overview
An attacker inflated a tokenized Google stock to about 7,700% over its real value on a DeFi lending protocol, then borrowed against the phantom collateral to drain the pool, per CoinDesk's July 1, 2026 report. Google's underlying share did not move; the token's on-protocol price did, most likely through manipulation of a thin or weakly guarded oracle. The case is one of the first to hit a tokenized blue-chip equity rather than a native crypto token, and it lands as tokenized-stock volume climbs into more lending markets. The practical takeaway for users: an RWA token is only as safe as the pricing and lending infrastructure wrapped around it, and "familiar" collateral like a Google share carries onchain failure modes that the stock itself does not.
