Summer.fi Lazy Summer Exploit (July 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2Es7R5…t4WTSummary
On July 6, 2026, an attacker drained approximately $6.04 million from Summer.fi's Lazy Summer Protocol vaults using $65.4 million in flash loans sourced from Morpho. The exploit exploited stale on-chain valuations of Silo 'Varlamore USDC Growth' tokens — mispriced assets left over from the November 2025 Stream Finance collapse — to artificially inflate vault net asset values and redeem shares at fraudulent prices. Stolen funds were converted to DAI and subsequently laundered through Tornado Cash.
Connected Entities
5 entities · 60 linked investigations- Uniswap→mentioned with→Ethereum(80%)
- Summer.fi Lazy Summer Exploit (July 2026)→mentioned with→Ethereum(65%)
- Summer.fi Lazy Summer Exploit (July 2026)→mentioned with→Summer.fi(80%)
- Summer.fi Lazy Summer Exploit (July 2026)→mentioned with→Uniswap(65%)
- Summer.fi Lazy Summer Exploit (July 2026)→mentioned with→Stream Finance(80%)
- Summer.fi→mentioned with→Stream Finance(80%)
- Summer.fi→mentioned with→Ethereum(80%)
- Summer.fi→mentioned with→Uniswap(65%)
- Stream Finance→mentioned with→Ethereum(70%)
2 submissions awaiting moderator review.
Timeline(15 events)
2016
Oasis.app created within the Maker Foundation as the original front-end for the Maker Protocol.
Summer.fi Official BlogJune 2021
Oasis.app spun out as an independent company following the Maker Foundation's decentralization.
CoinCodexJune 2023
Oasis.app rebrands to Summer.fi, expanding beyond MakerDAO to a multi-protocol DeFi interface.
Summer.fi Official Blog7 November 2025
Stream Finance collapses following a $93 million loss disclosure; xUSD stablecoin loses approximately 77% of value. Silo Varlamore USDC Growth tokens become economically impaired but are never marked down on-chain.
CryptoTimesApril 2026
Alleged attacker wallets are funded and begin systematically accumulating stale-valued Silo Varlamore USDC Growth tokens in preparation for the exploit, according to Summer.fi's post-mortem.
Summer.fi Official Blog (Post-Mortem)6 July 2026
At 05:17 AM UTC, attacker executes exploit using $65.4 million Morpho flash loan, donating stale-valued tokens to inflate LazyVault NAV and extracting approximately $6.04 million from LowerRisk and HigherRisk USDC vaults.
Summer.fi Official Blog (Post-Mortem)6 July 2026
At 05:36 AM UTC, Blockaid issues first public alert about the exploit.
Summer.fi Official Blog (Post-Mortem)6 July 2026
Stolen USDC is converted to DAI via Curve and transferred to attacker address 0x7BF716167B48CF527725722C6d79494b45B3BDCa.
CoinDesk6 July 2026
At 06:42 AM UTC, Block Analitica freezes deposit caps. PeckShield and CertiK confirm the attack.
Summer.fi Official Blog (Post-Mortem)6 July 2026
SUMR token declines by more than 18% following public disclosure of the exploit.
BeInCrypto6 July 2026
At 10:25 AM UTC, Guardian multisig completes pause of all Ethereum and Base Lazy Summer Protocol vaults.
Summer.fi Official Blog (Post-Mortem)6 July 2026
At 16:39 PM UTC, Summer.fi Foundation sweeps donated stale tokens to halt further NAV distortion.
Summer.fi Official Blog (Post-Mortem)8 July 2026
Attacker moves approximately $1.35 million in DAI through Tornado Cash mixer, converting to ETH via Uniswap before routing through an intermediary wallet.
The DefiantDecision Log
- slot 443522992 · hash M1jDgJue3ntQs5voZoE2APhHtVURCGNShREzu83SL6H
- slot 443522988 · hash H91iKJw3STzZVZn55eZ58bWVePxEGgJCVFrCJQ6D7hoT
- slot 443502916 · hash H4RtDfem93dVn1XMYWBfn8acwYfGXppGRzLmz6JGDzQ8
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 17 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/29/2026, 11:34:07 PM
last updated: 8/27/2026, 3:07:01 AM
4 viewsavoid.net — verified advice for a post-truth world