Summer.fi
Summary
Summer.fi (formerly Oasis.app) was a DeFi frontend and yield protocol platform with roots in the original MakerDAO ecosystem, operating for approximately seven years before shutting down in 2026. On July 6, 2026, an attacker exploited a share-accounting vulnerability in its Lazy Summer Protocol vaults via a $65.4 million flash loan, stealing approximately $6.04 million in depositor funds; the root cause was traced to stale Silo token valuations inherited from the November 2025 Stream Finance collapse. Following the exploit, Summer.fi Labs announced the permanent shutdown of operations, with the application scheduled to remain accessible through August 31, 2026 pending DAO-governed recovery of affected vault funds estimated at approximately $4 million.
Connected Entities
1 entities · 10 linked investigations- + 1 more
Timeline(12 events)
2016-01-01
OasisDEX launched as the original MakerDAO frontend, one of DeFi's earliest protocol interfaces.
Summer.fi Blog2021-01-01
Platform spun out from the Maker Foundation as an independent entity following MakerDAO decentralization.
Summer.fi Blog2023-06-01
Oasis.app rebranded to Summer.fi to reflect expansion beyond MakerDAO into a multi-protocol ecosystem.
CoinCodex2025-01-01
Lazy Summer Protocol launched as an automated yield vault product rebalancing across DeFi protocols.
Summer.fi Official2025-11-04
Stream Finance collapsed after disclosing approximately $93 million in losses by an external fund manager, triggering an estimated $285 million in DeFi contagion. Silo 'Varlamore' token valuations were never marked down following this collapse, creating the future exploit vector for Summer.fi.
BlockEden / CryptoTimes2026-04-01
Alleged attacker began pre-positioning: funding multiple wallets through identical paths and systematically accumulating Silo tokens that would become the attack lever, per Summer.fi post-mortem on-chain analysis.
Summer.fi Official Blog (Post-Mortem)2026-07-06
Exploit detected at 05:36 AM UTC: attacker used approximately $65.4 million flash loan via Morpho to manipulate Lazy Summer vault share accounting, extracting $6.04 million from two USDC vaults (LazyVault_LowerRisk_USDC: $5.64M; LazyVault_HigherRisk_USDC: $0.40M) in a single atomic transaction. Stolen USDC converted to DAI on Curve.
CoinDesk / Summer.fi Post-Mortem2026-07-06
Guardian Multisig paused all Ethereum vaults by 10:25 AM UTC and all vaults across Base, Arbitrum, and Sonic as precaution. Foundation Multisig swept donated Silo tokens from vault by 16:39 PM UTC. SUMR token declined over 18% following public disclosure.
Summer.fi Official Blog (Post-Mortem)2026-07-09
Approximately $1.35 million of stolen funds confirmed laundered through Tornado Cash via ETH batches after DAI-to-ETH swap on Uniswap. Approximately $4.67 million DAI reported remaining in exploiter wallet.
The Defiant / CryptoBriefing2026-07-20
Summer.fi confirmed permanent shutdown of both the user interface and Summer.fi Labs. Application to remain accessible through August 31, 2026; governance to transfer to Lazy Protocol DAO. Approximately $4 million in user assets remained temporarily illiquid with no guaranteed compensation.
Cryptonomist / Summer.fi Blog2026-08-31
Planned final date for Summer.fi application access and customer support. After this date, protocol governance to be handled exclusively by Lazy Protocol DAO.
Summer.fi Official BlogDecision Log
- #1publish⛓ pending7/25/2026, 12:18:51 PMhash: 3LZz5Nyo4ApsG6m3dZSe1K69GJ8SZqKrhCBsyb7AFDQG
0 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/25/2026, 12:18:43 PM
last updated: 7/25/2026, 12:18:51 PM
avoid.net — verified advice for a post-truth world