Summer.fi Exploit Drains About $6M In DAI From Lazy Summer Vaults

Summer.fi was hit by an active Ethereum exploit that drained about $6 million, primarily in DAI, after an attacker used a large flashloan to distort liquidity conditions across DeFi vault and pool interactions.

Blockaid’s Summer.fi exploit alert identified the ongoing drain against the DeFi yield platform, which operates the Lazy Summer Protocol and automated vault products for users seeking managed exposure to lending and yield markets.

The attacker used roughly $65.4 million in USDC and USDT through a flashloan, then moved through Morpho vaults, Curve pools and Lazy Summer vault functions including deposit, redeem and withdraw. The sequence converted the extracted value into DAI and sent the funds to an attacker-controlled address on Ethereum.

Summer.fi markets itself as a platform for automated DeFi yields, with the Lazy Summer Protocol designed to rebalance deposits across yield sources through vault infrastructure and keepers. The exploit turns that automated routing model into the center of the investigation, especially where vault accounting, liquidity assumptions and external protocol calls intersected.

Flashloan Route Used Morpho And Curve Liquidity

The early attack path points to liquidity manipulation rather than a simple user-side wallet drain. Flashloans allow an attacker to borrow large amounts of capital inside one transaction, use that capital to distort prices, balances or accounting inputs, then repay the loan before the transaction closes.

That structure can expose weak assumptions in vault systems that rely on external liquidity, redemption math or pool state at a precise moment. In the Summer.fi case, the attacker appears to have used temporary USDC and USDT liquidity to push through Morpho and Curve-linked interactions before redeeming value from Lazy Summer vaults.

The DAI concentration gives the stolen funds a more traceable but still mobile form. DAI can be followed across Ethereum wallets and DeFi routes, but it does not carry the same direct issuer-freeze path as centralized stablecoins such as USDC or USDT. Recovery now depends on whether the attacker moves funds into exchanges, bridges, mixers or additional swaps.

The incident lands close to earlier Ethereum DeFi drains where attackers concentrated stolen value into DAI. A recent SquidRouterModule exploit drained 86 Gnosis Safes and routed stolen tokens into DAI through attacker-controlled liquidity, showing how stablecoin conversion often becomes part of the first laundering step.

Vault Security Faces Another Stress Test

The Summer.fi exploit adds another hit to a year already defined by rapid DeFi losses, cross-protocol attack paths and automated strategy risk. Crypto exploit losses had already pushed higher after major protocol and bridge incidents, including the broader 2026 DeFi exploit wave that put vaults, bridges, oracles and private-key controls under heavier scrutiny.

Yield aggregators carry a different risk profile from single-protocol lending markets. They often route deposits across multiple strategies, rely on keepers or managers, interact with external lending pools and depend on clean accounting across several smart-contract layers. That design can improve access to yield, but it also creates more places where temporary liquidity distortions can hit.

The immediate checks now sit with Summer.fi and security researchers. Users need confirmation on affected vaults, disabled functions, remaining funds at risk, the exact failure point, whether new deposits or withdrawals are restricted, and whether any attacker-linked balances can be intercepted before further movement.

The post Summer.fi Exploit Drains About $6M In DAI From Lazy Summer Vaults appeared first on Crypto Adventure.