Summer.fi Lazy Summer Exploit (July 2026)
Summary
On July 6, 2026, an attacker drained approximately $6.04 million from Summer.fi's Lazy Summer Protocol vaults using $65.4 million in flash loans sourced from Morpho. The exploit exploited stale on-chain valuations of Silo 'Varlamore USDC Growth' tokens — mispriced assets left over from the November 2025 Stream Finance collapse — to artificially inflate vault net asset values and redeem shares at fraudulent prices. Stolen funds were converted to DAI and subsequently laundered through Tornado Cash.
Connected Entities
1 entities · 10 linked investigationsTimeline(15 events)
2016-01-01
Oasis.app created within the Maker Foundation as the original front-end for the Maker Protocol.
Summer.fi Official Blog2021-06-01
Oasis.app spun out as an independent company following the Maker Foundation's decentralization.
CoinCodex2023-06-01
Oasis.app rebrands to Summer.fi, expanding beyond MakerDAO to a multi-protocol DeFi interface.
Summer.fi Official Blog2025-11-07
Stream Finance collapses following a $93 million loss disclosure; xUSD stablecoin loses approximately 77% of value. Silo Varlamore USDC Growth tokens become economically impaired but are never marked down on-chain.
CryptoTimes2026-04-01
Alleged attacker wallets are funded and begin systematically accumulating stale-valued Silo Varlamore USDC Growth tokens in preparation for the exploit, according to Summer.fi's post-mortem.
Summer.fi Official Blog (Post-Mortem)2026-07-06
At 05:17 AM UTC, attacker executes exploit using $65.4 million Morpho flash loan, donating stale-valued tokens to inflate LazyVault NAV and extracting approximately $6.04 million from LowerRisk and HigherRisk USDC vaults.
Summer.fi Official Blog (Post-Mortem)2026-07-06
At 05:36 AM UTC, Blockaid issues first public alert about the exploit.
Summer.fi Official Blog (Post-Mortem)2026-07-06
Stolen USDC is converted to DAI via Curve and transferred to attacker address 0x7BF716167B48CF527725722C6d79494b45B3BDCa.
CoinDesk2026-07-06
At 06:42 AM UTC, Block Analitica freezes deposit caps. PeckShield and CertiK confirm the attack.
Summer.fi Official Blog (Post-Mortem)2026-07-06
SUMR token declines by more than 18% following public disclosure of the exploit.
BeInCrypto2026-07-06
At 10:25 AM UTC, Guardian multisig completes pause of all Ethereum and Base Lazy Summer Protocol vaults.
Summer.fi Official Blog (Post-Mortem)2026-07-06
At 16:39 PM UTC, Summer.fi Foundation sweeps donated stale tokens to halt further NAV distortion.
Summer.fi Official Blog (Post-Mortem)2026-07-08
Attacker moves approximately $1.35 million in DAI through Tornado Cash mixer, converting to ETH via Uniswap before routing through an intermediary wallet.
The DefiantDecision Log
- #1publish⛓ pending7/29/2026, 11:34:18 PMhash: H4RtDfem93dVn1XMYWBfn8acwYfGXppGRzLmz6JGDzQ8
17 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/29/2026, 11:34:07 PM
last updated: 7/30/2026, 8:05:51 AM
avoid.net — verified advice for a post-truth world