Summer.fi Reports $6 Million Exploit in DeFi Vault

Blockaid estimates the damage at about $6 million and links the attack to Lazy Summer vaults on Aave and Morpho. The SUMR token fell, while Summer.fi has not publicly responded yet.

Key Takeaways

• Summer.fi is believed to have been hit by an exploit that Blockaid says took about $6 million.
• Blockaid reported the attack on Monday and shared on-chain details about the attacker, the exploit contract, and the Lazy Summer contracts involved.
• The SUMR token fell 5.3 percent in 24 hours, while Summer.fi has not publicly commented on the incident yet.

Summer.fi appears to have been hit by an exploit that Blockaid says drained about $6 million (€5.2 million). The security firm said it flagged the incident on Monday and posted on-chain details tied to the attacker, the exploit contract, and the Lazy Summer contracts it believes were involved. The case puts another DeFi protocol under the microscope, where automated vaults and smart contracts can become exposed quickly when something breaks.

What Blockaid Saw

Blockaid said its detection system picked up the attack on Monday morning and initially put the losses at roughly $6 million (€5.2 million). It also published the attacker address, the exploit contract, and several Summer.fi and Lazy Summer addresses that it said were connected to the incident.

PeckShield also identified the main affected vault as LazyVault_LowerRisk_USDC, which is managed for risk by Block Analitica. The security firm said the vault's displayed APY briefly jumped to about 2.08 million percent. A move like that can be a sign of strain in a vault or pricing system, although it does not by itself explain the full extent of the losses.

Why This Matters

Summer.fi, which was previously known as Oasis.app, serves as the front end for the Lazy Summer Protocol, an onchain vault system that automatically routes deposits across DeFi venues such as Aave and Morpho. That design makes the platform simpler for users, but it also means it relies on several protocols at the same time. When something goes wrong, the fallout can spread beyond a single smart contract bug.

The incident also adds to a growing list of security issues across crypto. According to DeFiLlama, this is the second recorded crypto exploit in July, following a June in which crypto platforms lost a combined $75.87 million (€66.3 million) across 40 hacks. For European crypto readers, the main lesson is that liquidity, vault design, and risk controls can come under pressure very quickly, even on platforms built around automated diversification.

SUMR Under Pressure

The network's native token, SUMR, was trading near $0.00193 (€0.0017), down 5.3 percent over the past 24 hours. That move came while the broader market gained more than 1 percent on the day. Summer.fi has not publicly addressed the incident yet, so the situation should still be treated as ongoing and only partly confirmed.