Summer.fi DeFi Protocol Exploited for $6 Million in Flash Loan Attack

Jul 6, 2026

DeFi protocol Summer.fi was exploited for $6 million on July 6, 2026, in a flash loan attack that manipulated an ERC-4626 vault. The attacker used a $65.4 million loan to artificially distort the vault's share price, causing its displayed APY to briefly spike over 2,000,000%. The loss represents nearly a fifth of the protocol's total assets. In response, Summer.fi has paused all vaults in its Lazy Summer Protocol while it investigates the incident.

Summer.fi flash loan attack

▪Blockchain security firms Blockaid, PeckShield, and CertiK detected and reported the incident.
▪The attack was a flash loan attack targeting a share accounting vulnerability in the Lazy Summer protocol.
▪The DeFi protocol Summer.fi was exploited for approximately $6 million on July 6, 2026.
▪The attacker swapped the stolen $6 million into DAI stablecoins and moved them to a new address.

Vault manipulation mechanics

▪The attacker used a $65.4 million flash loan to manipulate the asset accounting of the protocol's vaults.
▪The attack was a donation-based inflation attack against an ERC-4626 standard vault.
▪The specific vault targeted was identified as LazyVault_LowerRisk_USDC.
▪The price manipulation allowed the attacker to redeem $70.9 million after making a $64.8 million deposit.

Artificial APY spike

▪During the exploit, the displayed Annual Percentage Yield (APY) of the targeted vault briefly spiked to approximately 2.08 million percent.
▪The manipulated vault had been marketed by developers as a lower-risk instrument.

Summer.fi security history

▪In the past year, Summer.fi has faced frozen withdrawals due to the USDX stablecoin depeg and blocked a malicious governance proposal.
▪The protocol, formerly known as Oasis.app, also recently avoided an attack through the rsETH project.

2026 DeFi sector losses

▪Q2 2026 saw a record number of attacks by incident count, with over 83 separate exploits.
▪By the start of Q3 2026, total losses from cyberattacks in the DeFi sector had exceeded $840 million for the year.

Victim impact response

▪In response to the attack, Summer.fi paused all vaults across its Lazy Summer Protocol.
▪A wallet linked to Torben Jorgensen, co-founder of UDHC, was a major victim, having deposited about 8.6 million USDC into the vault.
▪The $6 million loss represents nearly one-fifth of Summer.fi's total value locked of approximately $34.8 million.