Summer.fi DeFi Protocol Exploited for $6 Million in Flash Loan Attack

DeFi protocol Summer.fi was exploited for $6 million on July 6, 2026, in a flash loan attack that manipulated an ERC-4626 vault. The attacker used a $65.4 million loan to artificially distort the vault's share price, causing its displayed APY to briefly spike over 2,000,000%. The loss represents nearly a fifth of the protocol's total assets. In response, Summer.fi has paused all vaults in its Lazy Summer Protocol while it investigates the incident.

Summer.fi flash loan attack

• ▪Blockchain security firms Blockaid, PeckShield, and CertiK detected and reported the incident
• ▪The attack was a flash loan attack targeting a share accounting vulnerability in the Lazy Summer protocol
• ▪The DeFi protocol Summer.fi was exploited for approximately $6 million on July 6, 2026
• ▪The attacker swapped the stolen $6 million into DAI stablecoins and moved them to a new address

Vault manipulation mechanics

• ▪The attacker used a $65.4 million flash loan to manipulate the asset accounting of the protocol's vaults
• ▪The attack was a donation-based inflation attack against an ERC-4626 standard vault
• ▪The specific vault targeted was identified as LazyVault_LowerRisk_USDC
• ▪The price manipulation allowed the attacker to redeem $70.9 million after making a $64.8 million deposit

Artificial APY spike

• ▪During the exploit, the displayed Annual Percentage Yield (APY) of the targeted vault briefly spiked to approximately 2.08 million percent
• ▪The manipulated vault had been marketed by developers as a lower-risk instrument

Summer.fi security history

• ▪In the past year, Summer.fi has faced frozen withdrawals due to the USDX stablecoin depeg and blocked a malicious governance proposal
• ▪The protocol, formerly known as Oasis.app, also recently avoided an attack through the rsETH project

2026 DeFi sector losses

• ▪Q2 2026 saw a record number of attacks by incident count, with over 83 separate exploits
• ▪By the start of Q3 2026, total losses from cyberattacks in the DeFi sector had exceeded $840 million for the year

Victim impact response

• ▪In response to the attack, Summer.fi paused all vaults across its Lazy Summer Protocol
• ▪A wallet linked to Torben Jorgensen, co-founder of UDHC, was a major victim, having deposited about 8.6 million USDC into the vault
• ▪The $6 million loss represents nearly one-fifth of Summer.fi's total value locked of approximately $34.8 million