The Summer.fi protocol team has made a difficult but inevitable decision: after seven years of operation in DeFi, the project is ceasing operational activity. The reason is the July hack, in which an attacker siphoned $6.04 million. The user interface (UI) will remain accessible until August 31, but the future fate of the protocol itself now rests on the shoulders of the decentralized autonomous organization (DAO) governing it.
The developers honestly admitted: no viable path forward remained other than winding down the project. The financial losses were not just a blow — they completely stripped the team of the reserves needed to restore infrastructure and continue operations. A significant portion of the employees' own funds was held in the compromised vaults.
A Success Story Cut Short by a Hack
Summer.fi (formerly known as Oasis.app) had a long journey. The team spent two years as part of the Maker Foundation, and from June 2021, it developed as an independent project. During this time, over 50,000 people used the services. In the first nine months of operation, the Lazy Summer Protocol (the underlying protocol of Summer.fi) accumulated $200 million in total value locked (TVL). By the time of the attack, however, this figure had shrunk to $22 million, already indicating a decline in activity.
Technical Details of the Attack
The incident occurred on July 6. The attacker artificially manipulated the net asset value (NAV) of two USDC vaults of the Lazy Summer Protocol on the Ethereum network. Using a single atomic transaction, they withdrew funds: the low-risk vault lost $5.64 million, and the higher-risk product lost $400,000.
The key vulnerability was an error in the operational process, not in the smart contract code. The attack used Silo Varlamore USDC Growth vault tokens with outdated valuations. These were deposited into the Ark strategy, which was already being decommissioned. The Ark's deposit limit was set to zero, but the strategy was not removed from the active FleetCommander set. As a result, its assets continued to be accounted for in the NAV calculation, even though they were effectively "dead weight."
The attacker exploited this gap to artificially inflate the asset valuation and exchange them for real liquid funds from other strategies (Morpho, Spark, Sky). To execute the operation, they secured flash loans totaling over $65 million. According to the team, preparation for the attack began no later than April 6 — wallets linked to the hacker gradually accumulated Silo tokens for subsequent manipulation. After repaying the loans, the attacker converted the profit into DAI and laundered part of the funds through Tornado Cash.
Consequences and the Future
After the attack, all Lazy Summer Protocol vaults were suspended, and deposit limits in DAO-governed products were set to zero. The organization is currently carrying out procedures necessary to resume withdrawals. Once the functions are restored, they will appear in the Summer.fi interface. Support services and the Discord channel will continue operating until the end of August.
The closure of Summer.fi is not just the story of one project. It is a symptom of a crisis in the industry, where even veterans are not immune to fatal errors in operational processes. As noted by Aave founder Stani Kulechov, Summer.fi was one of the pioneers of DeFi. Its departure shows just how high the stakes and costs are when creating a quality and secure access point to decentralized finance. For context, in the first half of 2026, crypto projects lost approximately $972 million across 207 incidents, according to Immunefi. And this is just the tip of the iceberg.
My professional opinion: The Summer.fi hack is a classic example of how "human factors" and incomplete procedures can cost a project. The absence of a bug in the smart contract code does not make the attack any less devastating. It is a harsh reminder to the entire industry: security is not just about code, but also about flawless operational processes. If you decommission a strategy, do it cleanly — otherwise, you risk losing everything.