Summer.fi pauses vaults after $6 million exploit

The decentralized finance protocol Summer.fi has halted operations of its automated vaults after an exploit drained approximately $6 million from the platform on Monday, July 6, 2026. The incident, first detected by blockchain security firm Blockaid, involved a complex flash loan attack that manipulated the protocol's internal accounting.

Early analyses from multiple security researchers indicate the attacker borrowed around $65 million via a flash loan, likely through the Morpho protocol, within a single transaction. The borrowed capital was used to manipulate liquidity and distort the price accounting in Summer.fi's Lazy Summer Protocol vaults, specifically targeting its USDC vaults. This manipulation artificially inflated the total assets recorded, allowing the attacker to redeem approximately $70.9 million after a $64.8 million deposit, netting a profit of roughly $6 million before repaying the flash loan. The stolen funds were subsequently converted to the DAI stablecoin and transferred to an attacker-controlled wallet.

In response, protocol guardians paused all affected Lazy Summer vaults to prevent further losses. The platform's native token, SUMR, fell by over 18%...