On July 6, 2026, the DeFi protocol Summer.fi fell victim to a targeted hacker attack. The project team promptly confirmed the incident and suspended all vault operations within the Lazy Summer Protocol ecosystem. The investigation is currently in its early stages, and the exact amount of damage and technical details of the exploit have not been officially disclosed.
Attack Mechanism: Flash Loans and Distortion of totalAssets()
An analysis of the incident conducted by Cyvers and CertiK experts revealed a sophisticated scheme. The attacker exploited a vulnerability in the asset share accounting mechanism underlying the protocol's operation. A key element of the attack was the distortion of the totalAssets() metric in the FleetCommander smart contracts responsible for managing vaults.
To execute the plan, the hacker obtained a flash loan of $65.4 million. These funds were used to temporarily inflate the liquidity volume within the protocol, after which the attacker initiated a withdrawal of approximately $70.9 million. The net profit from the manipulation was about $6 million, which was converted into DAI stablecoins and transferred to an external address.
Systemic Vulnerability of Lazy Summer
Experts emphasize that the root of the problem lies in the architecture of Lazy Summer—a system that automatically redistributes user deposits across various lending platforms. The attack affected the Ark contract, which acts as a bridge between the protocol and external lending services. It was through this component that the hacker was able to manipulate prices and shares, bypassing standard protection mechanisms.
This incident serves as a reminder that even complex DeFi protocols with automated liquidity management strategies remain vulnerable to attacks based on distorting internal metrics. Against the backdrop of a decline in total losses from crypto hacks in June to $75.9 million (across 40 incidents), the Summer.fi case highlights the need for more thorough auditing of smart contracts, especially those dealing with flash loans and dynamic asset allocation.