Summer.fi

DeFi · Crypto Security

Milestone

Summer.fi shuts down after $6M vault exploit ends five-year DeFi run

The team's own capital sat inside the drained vaults, erasing the reserve that might have funded a rebuild.

• Summer.fi and its Labs company are winding down after a July 6 exploit drained roughly $6.04M from two USDC vaults on the Lazy Summer Protocol, the team announced on its blog.
• Summer.fi, formerly Oasis.app, spun out of the Maker Foundation in June 2021 and built tools like Multiply and Vault Automation to help over 50,000 users manage leveraged DeFi vault positions.
• The attacker manipulated vault net asset value by donating overvalued Silo Varlamore vault tokens, extracting the funds from two Ethereum USDC vaults in a single atomic transaction.
• The theft split roughly $5.64M from the LazyVault_LowerRisk_USDC vault and about $0.40M from the LazyVault_HigherRisk_USDC vault.
• Lazy Summer Protocol had grown to about $200M in TVL within its first nine months before DeFi conditions worsened following the October 2025 Stream Finance collapse.
• The Summer.fi app will stay live until August 31 while the community-governed Lazy Summer DAO works to resume withdrawals and redemptions across all vaults, including the two exploited ones.
• The collapse shows how a single vault-accounting exploit can end an established DeFi protocol when a team's operating capital is commingled with the user funds it manages.