Summer.fi Loses $6 Million in Flash-Loan Attack

Summer.fi is an Ethereum-based DeFi yield optimization protocol whose Lazy Summer product uses automated vaults to allocate funds across lending markets including Aave and Morpho. Flash loans allow large amounts of assets to be borrowed and repaid within a single transaction. If vault pricing or liquidity is manipulated, depositors can suffer rapid losses, underscoring the risks of automated yield strategies.

Blockaid first raised the alarm over an attack on Summer.fi on July 6, 2026. CertiK said the attacker obtained a $65.4 million flash loan, manipulated the Lazy Summer vaults and then redeemed $70.9 million. Two Ethereum USDC vaults lost about $6.04 million in total, prompting the protocol to immediately pause all vaults and investigate the cause.