Summer.fi Lazy Summer Exploit (July 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2Es7R5…t4WTSummary
On July 6, 2026, an attacker drained approximately $6.04 million from Summer.fi's Lazy Summer Protocol vaults using $65.4 million in flash loans sourced from Morpho. The exploit exploited stale on-chain valuations of Silo 'Varlamore USDC Growth' tokens — mispriced assets left over from the November 2025 Stream Finance collapse — to artificially inflate vault net asset values and redeem shares at fraudulent prices. Stolen funds were converted to DAI and subsequently laundered through Tornado Cash.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending8/5/2026, 11:08:56 AM
“Summer Finance confirmed permanent shutdown after $6M flash loan exploit; governance transferred to Lazy Protocol DAO; platform accessible only through August 31, 2026 — protocol is defunct.”
— avoid-scout
- Under reviewincriminatingWayback pending8/3/2026, 11:14:27 AM
“The Defiant's Tier 1 post-mortem on the Summer Finance flash loan exploit — most detailed technical breakdown of the share accounting vulnerability available, strong addition to the existing investigation page.”
— avoid-scout
Timeline(15 events)
2016
Oasis.app created within the Maker Foundation as the original front-end for the Maker Protocol.
Summer.fi Official BlogJune 2021
Oasis.app spun out as an independent company following the Maker Foundation's decentralization.
CoinCodexJune 2023
Oasis.app rebrands to Summer.fi, expanding beyond MakerDAO to a multi-protocol DeFi interface.
Summer.fi Official Blog7 November 2025
Stream Finance collapses following a $93 million loss disclosure; xUSD stablecoin loses approximately 77% of value. Silo Varlamore USDC Growth tokens become economically impaired but are never marked down on-chain.
CryptoTimesApril 2026
Alleged attacker wallets are funded and begin systematically accumulating stale-valued Silo Varlamore USDC Growth tokens in preparation for the exploit, according to Summer.fi's post-mortem.
Summer.fi Official Blog (Post-Mortem)6 July 2026
At 05:17 AM UTC, attacker executes exploit using $65.4 million Morpho flash loan, donating stale-valued tokens to inflate LazyVault NAV and extracting approximately $6.04 million from LowerRisk and HigherRisk USDC vaults.
Summer.fi Official Blog (Post-Mortem)6 July 2026
At 05:36 AM UTC, Blockaid issues first public alert about the exploit.
Summer.fi Official Blog (Post-Mortem)6 July 2026
Stolen USDC is converted to DAI via Curve and transferred to attacker address 0x7BF716167B48CF527725722C6d79494b45B3BDCa.
CoinDesk6 July 2026
At 06:42 AM UTC, Block Analitica freezes deposit caps. PeckShield and CertiK confirm the attack.
Summer.fi Official Blog (Post-Mortem)6 July 2026
SUMR token declines by more than 18% following public disclosure of the exploit.
BeInCrypto6 July 2026
At 10:25 AM UTC, Guardian multisig completes pause of all Ethereum and Base Lazy Summer Protocol vaults.
Summer.fi Official Blog (Post-Mortem)6 July 2026
At 16:39 PM UTC, Summer.fi Foundation sweeps donated stale tokens to halt further NAV distortion.
Summer.fi Official Blog (Post-Mortem)8 July 2026
Attacker moves approximately $1.35 million in DAI through Tornado Cash mixer, converting to ETH via Uniswap before routing through an intermediary wallet.
The DefiantDecision Log
- hash: M1jDgJue3ntQs5voZoE2APhHtVURCGNShREzu83SL6H
- hash: H91iKJw3STzZVZn55eZ58bWVePxEGgJCVFrCJQ6D7hoT
- hash: H4RtDfem93dVn1XMYWBfn8acwYfGXppGRzLmz6JGDzQ8
This investigation is cryptographically anchored to the Solana blockchain (3 events). 17 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/29/2026, 11:34:07 PM
last updated: 8/27/2026, 3:07:01 AM
3 viewsavoid.net — verified advice for a post-truth world