Summer.fi Suffers $6M Exploit After External DeFi Market Failure

Highlights:

• The Summer.fi exploit reportedly drained about $6 million from the platform’s Lazy Summer vault.
• Summer.fi has not released an official statement or technical report about the exploit at the time of reporting.
• CertiK said the attacker may have used a $65.4 million flash loan to manipulate liquidity and generate about $6 million in profit.

Summer.fi, a decentralized finance yield platform, has reportedly suffered an exploit that drained about $6 million from one of its vaults. Blockchain security firm Blockaid detected the incident and published an alert on Monday after identifying active fund outflows. The firm estimated that attackers had already drained roughly $6 million by the time it issued the warning. However, Summer.fi had not released an official statement or technical report at the time of reporting.

Blockaid: Summer fi Under Attack, About $6M Drained

According to Blockaid, its exploit detection system identified an ongoing exploit on Summer fi, with about $6 million drained so far. Summer fi is a DeFi yield aggregation and automated vault management platform that provides… pic.twitter.com/JMFeFLpYi7

— Wu Blockchain (@WuBlockchain) July 6, 2026

Summer.fi operates the Lazy Summer Protocol, which automates decentralized finance yield strategies by allocating deposited assets across selected protocols. The platform also provides self-managed institutional vaults that allow organizations to retain control of private keys while accessing decentralized finance and tokenized real-world asset yield opportunities.

Summer.fi Exploit Reveals Hidden Risks Across Yield Strategies

Blockchain security firm PeckShield later identified LazyVault_LowerRisk_USDC (LVUSDC) as the main affected vault. The firm said Block Analitica manages risk for that vault. PeckShield also reported that the vault’s displayed annual percentage yield briefly surged to about 2.08 million%, indicating abnormal activity during the exploit.

#PeckShieldAlert Main affected vault: @summerfinance_ LazyVault_LowerRisk_USDC (LVUSDC), risk-managed by @BlockAnalitica.

LVUSDC’s displayed APY briefly spiked to ~2.08M%.

The largest current holder is 0x8741e8f…4130, which appears to be associated with Torben Jorgensen… pic.twitter.com/jscIC554Ee

— PeckShieldAlert (@PeckShieldAlert) July 6, 2026

PeckShield also identified the vault’s largest current holder as wallet address 0x8741e8f…4130, which it said appears associated with Torben Jorgensen (UDHC). According to the security firm, that address had deposited about 8.6 million USDC into the affected vault. However, PeckShield did not identify that wallet as part of the exploit or accuse its owner of any wrongdoing.

Blockchain security firm CertiK said the attacker generated about $6 million in profit by using a flash loan worth roughly $65.4 million to manipulate liquidity. However, CertiK did not state that its findings represented the confirmed cause of the exploit.

1/ Attacker was able to redeem $70.9M following $64.8M deposit thanks to manipulation of FleetCommander's accounting of totalAssets() on a host of vaults, particularly Silo: Varlamore USDC Growth, which the attacker had accumulated beforehand and donated to the Ark in between. pic.twitter.com/x2eeKlWy3n

— CertiK Alert (@CertiKAlert) July 6, 2026

A flash loan allows users to borrow large amounts of cryptocurrency without providing collateral, provided they repay the funds within the same blockchain transaction. According to CertiK, attackers can use the borrowed funds to manipulate liquidity or on-chain prices before repaying the loan and keeping the profits. Security researchers have long recommended safeguards such as time-weighted average pricing, multi-source oracles, and circuit breakers to reduce the risk of similar attacks.

Major Crypto Hacks Extend Across DeFi

The Summer.fi exploit adds to a growing list of crypto security incidents reported during June. Blockchain security firm PeckShield said hackers carried out 40 major security breaches during the month. The firm estimated total losses at about $75.87 million, down 7.13% from the $81.7 million recorded in May.

Humanity Protocol recorded the largest single loss during June after attackers stole about $31 million. Investigators linked the breach to a compromised private key stored on a malware-infected developer laptop. The attackers later moved the stolen assets across Bitcoin, Solana, Hyperliquid, and BNB Chain to obscure the transaction trail.

Syscoin Bridge recorded the second-largest loss after an attacker exploited a flaw in its transaction proof verification process. The vulnerability allowed the attacker to mint about 5 billion unauthorized SYS tokens worth nearly $10 million. However, Syscoin later traced the unauthorized tokens and burned the entire supply a few days after the attack.