DeFi protocol Summer.fi ceases to exist after a $6 million hack: a fatal blow to the project
Another project in the decentralized finance (DeFi) sector is coming to an end. The Summer.fi protocol, which had been operating since 2019, has officially announced its closure. The reason was a catastrophic hack that occurred on July 6, resulting in $6.04 million being drained from the Lazy Summer protocol. The team had no reserves left for recovery.
Incident Details and Protocol Vulnerability
The attacker targeted two liquidity pools, manipulating the price of shares in USDC vaults on Ethereum. The main blow was dealt to the LazyVault_LowerRisk_USDC pool, from which nearly 5.64 million USDC was stolen. From the LazyVault_HigherRisk_USDC pool, the attacker withdrew an additional approximately 0.40 million USDC. The key issue was that a significant portion of the project's own funds were stored in the attacked pools, leaving the team unable to compensate for the losses.
Why the Project Could Not Be Saved
The Summer.fi team explained their decision in detail. The overall downturn in DeFi, exacerbated by the aftermath of the Stream Finance incident in October 2025, undermined the project's financial stability. The July hack was a "devastating" blow, after which recovery became impossible. The developers emphasized that all alternatives were considered, but stopping the project was the only way out, albeit an extremely difficult one.
"We considered all alternatives and came to the conclusion: stopping the project is the only way out, even if it is very difficult for us," the team stated.
What Will Happen to Users
Despite the closure, the Summer.fi and Lazy Summer DAO teams intend to restore the withdrawal and redemption procedure in all pools for affected users. The application will be available until August 31, and after all processes are completed, access to the pools will be reopened through the Summer.fi interface. This will allow users to retrieve their assets.
Alarming Trend in DeFi
Summer.fi is far from the only project to fall victim to hackers. In June, Radiant Capital ceased operations after a $50 million theft. In February, Step Finance closed due to a treasury hack. These attacks proved fatal for protocols that could not recover from financial losses.
Expert Opinion from Cryptalist
This case is a stark reminder that in DeFi, smart contract security and risk management must be an absolute priority. Manipulating share prices in pools is a classic but still effective attack that can destroy even mature projects. Investors should be extremely careful in assessing where a protocol's own funds are stored, as their loss often means the end of the project.