0:00
0:00
Subscribe to Bankless or sign in
An attacker siphoned just over $6M from two Lazy Summer Protocol USDC vaults on 
Ethereum yesterday, per the team's post-mortem. The vector entailed inflating the vaults' share prices in flash loan transactions, after which the exploiter cashed out against other depositors' capital.
⚠️ Security Notice
— Summer.fi ☀ (@summerfinance_) July 6, 2026
We identified an active exploit affecting the Lazy Summer Protocol earlier today. As a precaution, Guardians have paused all vaults and set deposit caps to zero across networks.
The situation is being actively assessed. Please do not interact with the protocol…
What's the Scoop?
- The exploit: The attacker donated Silo "Varlamore" tokens, still carrying stale, never-marked-down valuations from November 2025's Stream Finance collapse, into a strategy module that had been capped for removal but still counted toward vault NAV. That pumped the share price ~9.5%, letting them redeem ~$71M against a ~$64.8M deposit.
- Months of prep: Involved allets began accumulating the mispriced tokens roughly three months ago, all funded via the same path, so it's clear this compromise was meticulously planned rather than opportunistic.
- The response: Every vault protocol-wide was paused and capped to zero, marking the first live-exploit use of the Lazy Summer DAO's Guardian multisig. The attacker has since routed funds through Tornado Cash, so the possibility of compensation for victims now rests in the hands of Lazy Summer DAO governance.
- Zooming out: Notably, Lazy Summer's smart contracts worked exactly as intended. Instead, the hole was operational, i.e. a half-offboarded market left priced into NAV. The incident is a stark reminder to DeFi projects that decommissioning hygiene is security, too.
