Summer Finance paused every Lazy Summer Protocol vault on Monday, July 6, after an attacker used a $65.4 million flash loan to drain an estimated $6 million from the DeFi protocol. Security firms traced a multi-step manipulation of the protocol’s accounting logic, and the loss pushed total DeFi ecosystem losses past $840 million in 2026.
An attacker turned a $65.4 million flash loan into a $6 million theft from Summer Finance on Monday, July 6, prompting the protocol to pause all Lazy Summer Protocol vaults while its core developers work on a full patch. Blockchain security firms flagged the breach against the decentralized finance yield optimization protocol through real-time onchain analytics.
How the attack worked
The exploit hinged on a multi-step manipulation of the protocol’s accounting logic. Certik’s analysis found that the attacker initiated a $65.4 million flash loan to distort the asset valuation framework of the Lazy Summer Protocol vault, which is managed under Summer.fi.
By exploiting a vulnerability in the Fleet Commander contract’s asset accounting logic, the attacker skewed how the system calculated token value. After depositing roughly $64.8 million into the manipulated ecosystem, the actor ran an arbitrage maneuver to redeem $70.9 million in assets. According to Cyvers, the exploiter then swapped the $6 million profit into DAI before funneling the funds into an attacker-controlled wallet to break the paper trail.
What Summer Finance told users
The team confirmed the breach and said it was investigating the root cause, stating: “The protocol guardians are currently pausing all Vaults across the Lazy Summer Protocol.”
Because the developers are still preparing a post-mortem, security experts urged users to revoke permissions or cancel active smart contract approvals tied to the affected vaults. They also advised verifying communications through official channels and moving assets from hot wallets into cold storage until the underlying protocols are patched. The theft added to a rising trend of infrastructure-level arbitrage manipulation that has driven DeFi losses past $840 million this year.
Source: Bitcoin News
Trading involves risk.
Risk Disclaimer
