On July 6, the decentralized finance protocol Summer.fi fell victim to a targeted hacker attack. The project team confirmed the incident and immediately suspended all vault operations within the Lazy Summer Protocol to conduct an investigation.
According to my data, the attacker used a sophisticated scheme based on a $65.4 million flash loan. This allowed them to temporarily inflate the volume of funds in the protocol and initiate a withdrawal of approximately $70.9 million. The hacker's net profit was roughly $6 million, which they converted into DAI stablecoins and transferred to their wallet.
As security experts determined, the key vulnerability was embedded in the mechanism for accounting asset shares. The attacker manipulated the totalAssets() indicator in the FleetCommander smart contracts, which are responsible for managing liquidity pools. An additional attack vector was the Ark contract, which connects the protocol to external lending platforms. It was precisely the distortion of data on total assets that allowed the hacker to withdraw funds significantly exceeding their actual deposit.
Notably, the attack on Summer.fi occurred against the backdrop of a general trend of declining losses from crypto hacks. In June 2026, total losses amounted to $75.9 million across 40 incidents, with the largest attack of the month being the theft of $31 million from Humanity Protocol. However, the second quarter set an anti-record for the number of exploits — 83 cases, which is the highest figure ever recorded.
My analysis: This attack once again demonstrates the critical importance of auditing pricing mechanisms and asset accounting in DeFi protocols. The use of flash loans combined with the totalAssets() vulnerability is a classic yet still effective vector. Investors should pay attention to projects that implement dynamic oracles and multi-level pool state verification. Without this, even large protocols remain vulnerable to such manipulations.