Summer Finance (Summer.fi) — Lazy Summer Protocol Flash Loan Exploit and Shutdown

2025-11

Stream Finance collapses following a $93 million loss disclosed by an external fund manager; xUSD token crashes 77%, leaving Silo Varlamore USDC Growth tokens with stale inflated on-chain valuations.

2026-04-06

Attacker begins funding multiple wallets and systematically accumulating stale Silo Varlamore tokens in preparation for the exploit, approximately three months before execution.

2026-07-06

At 05:17 AM UTC, attacker executes single atomic transaction using a $65.4 million Morpho flash loan to manipulate share prices across two Lazy Summer USDC vaults, extracting approximately $6.04 million in DAI.

2026-07-06

At 05:36 AM UTC, Blockaid flags the attack. By 06:42 AM UTC, deposit caps are zeroed on affected vaults. At 10:25 AM UTC, Guardian multisig pauses all Lazy Summer Protocol vaults on Ethereum, Base, Arbitrum, and Sonic.

2026-07-06

SUMR token declines more than 18% following public disclosure of the exploit.

2026-07-09

Attacker begins laundering stolen funds through Tornado Cash; approximately $1.35 million in DAI has been converted to ETH and deposited into the mixer in batches of 10 ETH or larger.

2026-07-15

Summer.fi Labs publishes formal shutdown announcement, stating the company has 'no viable path forward other than to wind down operations.' The application is to remain live until August 31, 2026.

2026-07-30

Lazy Summer DAO completes offboarding cleanup across all networks via governance proposals SIP1.7, SIP1.8, SIP1.9, SIP2.59.1-12, and SIP7.3.1-2; all Lazy Summer Vaults reopened for withdrawal, with affected vault users directed to Merkl distribution contracts.

2026-08-31

Final operational date for the Summer.fi application and support channels. Lazy Summer Protocol smart contracts remain deployed on-chain under DAO governance.