Summer.fi Loses $6 Million as Flash Loan Exploit Triggers 2,080,000% APY Glitch

• Summer.fi lost $6 million after a flash loan exploit manipulated automated vault pricing, draining DAI before investigators launched ongoing reviews.
• Security researchers linked the attack to a $65.4 million flash loan that inflated APY calculations temporarily, enabling unauthorized withdrawals successfully.
• Previous security incidents and rising DeFi losses highlight growing pressure for stronger protocol safeguards across multichain ecosystems industrywide this year.

 

Major DeFi protocol Summer.fi is investigating a $6 million exploit that compromised one of its lower-risk automated vaults. According to blockchain security firms Blockaid, PeckShield, and CertiK, the attacker manipulated the protocol with a $65.4 million flash loan before draining DAI stablecoins in a single blockchain transaction.

The exploit targeted the protocol’s LazyVault_LowerRisk_USDC pool, which Summer.fi had promoted as a conservative investment product. Instead of targeting user wallets, the attacker manipulated liquidity inside the vault and disrupted its pricing mechanism. Consequently, the protocol briefly displayed an annual percentage yield of about 2,080,000%.

That pricing error created a narrow opportunity to withdraw approximately $6 million in DAI stablecoins. Although the abnormal reading lasted only briefly, the attacker completed the exploit before the protocol returned to normal operation.

Security firms detected the suspicious activity within minutes and alerted the crypto community. However, investigators have not identified the attacker or confirmed whether any of the stolen assets have been recovered.

Also Read: Bitcoin Developer Says It Is Too Late to Cancel BIP110 Despite Growing Debate

Flash loan exploit reveals weaknesses in automated vaults

Unlike conventional crypto thefts, this exploit relied on a flash loan instead of stolen credentials or compromised wallets. Flash loans allow users to borrow substantial amounts of cryptocurrency without collateral, provided repayment occurs within the same transaction.

According to preliminary findings, the attacker borrowed roughly $65.4 million to manipulate liquidity inside the affected vault. As a result, the protocol temporarily generated inaccurate pricing data that inflated the displayed APY. The manipulated calculations then enabled the unauthorized withdrawal before the flash loan was repaid.

Moreover, the incident highlights the risks facing automated yield vaults that rely on real-time pricing mechanisms. Even products marketed as lower risk can become vulnerable when valuation models fail under extreme market conditions.

Summer.fi faces another setback across its multichain ecosystem

The latest exploit adds to a challenging period for Summer.fi, formerly known as Oasis.app. The protocol operates across Ethereum, Base, and Arbitrum and has encountered several operational and security incidents over the past year.

Previous challenges included frozen withdrawals following the USDX stablecoin depeg. Additionally, the protocol narrowly avoided an exploit involving the rsETH project. Developers also blocked a malicious governance proposal that attempted to abuse outdated access permissions before it caused damage.

Those incidents differed in execution, yet each exposed risks within the protocol’s broader infrastructure. Consequently, the latest attack is likely to increase scrutiny of Summer.fi’s security architecture and automated vault design.

DeFi security losses continue climbing in 2026

The Summer.fi exploit also reflects the wider security challenges affecting decentralized finance this year. Cybercriminals have increasingly targeted lending platforms, automated vaults, and liquidity protocols using more sophisticated attack methods.

Industry analysts estimate that DeFi-related cyberattacks had already generated more than $840 million in losses before the third quarter of 2026. Furthermore, April alone accounted for over $640 million of those losses, making it the costliest month for DeFi exploits so far this year.

The latest attack demonstrates how flash loan exploits continue challenging decentralized finance platforms despite stronger security monitoring. While the investigation remains ongoing, the incident reinforces the importance of resilient pricing systems and stronger safeguards for automated investment products.

Also Read: XRP Faces Critical Two-Week Close as EGRAG Flags Key Breakout Levels Ahead Today

The post Summer.fi Loses $6 Million as Flash Loan Exploit Triggers 2,080,000% APY Glitch appeared first on 36Crypto.