Summer Finance (Summer.fi) — Lazy Summer Protocol Flash Loan Exploit and Shutdown
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2DAPJw…1w3nSummary
On July 6, 2026, an attacker used a $65.4 million Morpho flash loan to exploit a stale-asset share-price manipulation vulnerability in Summer.fi's Lazy Summer Protocol, extracting approximately $6.04 million in DAI from two Ethereum USDC vaults. The stolen funds were subsequently laundered through Tornado Cash. On July 15, 2026, Summer.fi Labs announced it had no viable path forward and would cease operations by August 31, 2026, with governance of the Lazy Summer Protocol transferring entirely to the Lazy Summer DAO.
Connected Entities
5 entities · 60 linked investigations- Summer Finance (Summer.fi) — Lazy Summer Protocol Flash Loan Exploit and Shutdown→mentioned with→Stream Finance(80%)
- Summer.fi→mentioned with→Stream Finance(80%)
- Summer.fi→mentioned with→Arbitrum(65%)
- Summer.fi→mentioned with→Ethereum(80%)
- Summer Finance (Summer.fi) — Lazy Summer Protocol Flash Loan Exploit and Shutdown→mentioned with→Ethereum(70%)
- Summer Finance (Summer.fi) — Lazy Summer Protocol Flash Loan Exploit and Shutdown→mentioned with→Summer.fi(80%)
- Summer Finance (Summer.fi) — Lazy Summer Protocol Flash Loan Exploit and Shutdown→mentioned with→Arbitrum(65%)
- Stream Finance→mentioned with→Ethereum(70%)
- Stream Finance→mentioned with→Arbitrum(60%)
- Arbitrum→mentioned with→Ethereum(80%)
Timeline(9 events)
November 2025
Stream Finance collapses following a $93 million loss disclosed by an external fund manager; xUSD token crashes 77%, leaving Silo Varlamore USDC Growth tokens with stale inflated on-chain valuations.
CryptoTimes6 April 2026
Attacker begins funding multiple wallets and systematically accumulating stale Silo Varlamore tokens in preparation for the exploit, approximately three months before execution.
Summer.fi Exploit Post-Mortem (official)6 July 2026
At 05:17 AM UTC, attacker executes single atomic transaction using a $65.4 million Morpho flash loan to manipulate share prices across two Lazy Summer USDC vaults, extracting approximately $6.04 million in DAI.
Summer.fi Exploit Post-Mortem (official)6 July 2026
At 05:36 AM UTC, Blockaid flags the attack. By 06:42 AM UTC, deposit caps are zeroed on affected vaults. At 10:25 AM UTC, Guardian multisig pauses all Lazy Summer Protocol vaults on Ethereum, Base, Arbitrum, and Sonic.
Summer.fi Exploit Post-Mortem (official)9 July 2026
Attacker begins laundering stolen funds through Tornado Cash; approximately $1.35 million in DAI has been converted to ETH and deposited into the mixer in batches of 10 ETH or larger.
The Defiant15 July 2026
Summer.fi Labs publishes formal shutdown announcement, stating the company has 'no viable path forward other than to wind down operations.' The application is to remain live until August 31, 2026.
Summer.fi blog (official)30 July 2026
Lazy Summer DAO completes offboarding cleanup across all networks via governance proposals SIP1.7, SIP1.8, SIP1.9, SIP2.59.1-12, and SIP7.3.1-2; all Lazy Summer Vaults reopened for withdrawal, with affected vault users directed to Merkl distribution contracts.
Summer.fi blog (official)31 August 2026
Final operational date for the Summer.fi application and support channels. Lazy Summer Protocol smart contracts remain deployed on-chain under DAO governance.
Summer.fi — Sunsetting Summer.fi and the Labs CompanyDecision Log
- hash: FPgHomt9gA5eroUcoXyBc8Mr8KGxVGeLv5nTkLHrwcMR
- hash: DpypvF2cHsa7bHibJmpaJHNav5BzWDvMKfxNLfPLvtRq
- hash: 3FEE5J7WsYVoyikwzy6xRKh2e6VPzPckFkL54YEzC7m3
This investigation is cryptographically anchored to the Solana blockchain (3 events). 19 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/9/2026, 12:24:55 PM
last updated: 8/25/2026, 7:48:05 PM
5 viewsavoid.net — verified advice for a post-truth world