Lazy Summer Protocol hack — July 2026

On 6 July 2026 at 05:17 UTC an attacker took about $6.04 million from two USDC vaults of Lazy Summer Protocol, the automated yield product run by Summer.fi, on Ethereum mainnet. The protocol's post-mortem breaks the loss down as roughly $5.64 million from LazyVault_LowerRisk_USDC and about $0.40 million from LazyVault_HigherRisk_USDC.

Lazy Summer vaults allocate deposits to external strategies through adapters the protocol calls Arks, and price vault shares from the total assets those Arks report. Risk curator BA Labs had set the deposit caps on a Silo Ark and a Term Finance Ark to zero on 30 October and 6 November 2025, but capping an Ark does not remove it from the total-assets calculation. The Silo Ark continued to value "Varlamore USDC Growth" vault tokens at a figure that never corrected after the collapse of Stream Finance in November 2025.

According to the post-mortem and an independent analysis by Verichains, the attacker flash-borrowed 65,419,171.88 USDC and 1,000,000 USDT from Morpho Blue, deposited into the lower-risk vault at the honest share price, transferred stale Silo tokens directly into the still-active capped Ark to inflate reported net asset value by roughly 9.5 percent, redeemed shares at the inflated price, repaid the loans and left with about $6.02 million in DAI. Verichains attributes the failure to incomplete strategy offboarding and states explicitly that it was not a compromised-key or malicious-admin incident.

Summer.fi said the attacker had funded wallets and accumulated the necessary Silo tokens over roughly three months, which contradicted early descriptions of an opportunistic flash-loan attack. BA Labs executed the first emergency transaction pausing deposits on mainnet at about 06:37 UTC, some eighty minutes after the exploit, and the protocol's Guardian module executed pause transactions across the Ethereum and Base vaults at 10:25 UTC, roughly four hours after. Part of the proceeds was routed through Tornado Cash. No funds have been recovered and compensation was left to a DAO governance decision.