According to on-chain data received on Monday, decentralized finance (DeFi) yield-optimization protocol Summer Finance – also known as Summer.fi – suffered a smart contract exploit resulting in a loss of funds worth at least $6 million.
Summer Finance suffers theft of $6 million
Protocol attacks don’t appear to be slowing down in the DeFi space, with the latest victim being Summer Finance. The following wallet address belonging to the attacker – as identified by blockchain security firm Blockaid – shows that the wallet held more than $6 million in funds on Monday.
Another blockchain investigating X account, Cyvers Alerts, noted that the perpetrator’s wallet address was funded on the Base network. The account said that the root cause behind the attack was likely due to a shared accounting vulnerability through price manipulation.
They added that the funds stolen from Summer Finance were later swapped to decentralized stablecoin DAI and moved to an attacker controlled address.
Another leading on-chain investigating firm, CertiK, chimed in with their analysis, saying that the attacker was able to redeem $70.9 million following a $64.8 million deposit by affecting how Summer Finance’s Lazy Summer Protocol accounted for assets in its vaults.
To explain, Summer Finance is a protocol that automatically moves users’ funds between different lending platforms to maximize potential yield without requiring manual intervention.
Its AI-powered keepers continuously monitor market conditions and rebalance deposits to pursue the highest available returns. According to CertiK, the protocol’s Fleet Commander smart contract was targeted, since it is the one that manages the vaults.
By manipulating the smart contract – particularly involving the Silo: Varlamore USDC Growth vault – the attacker made the protocol believe their deposit was worth more than it actually was, allowing them to redeem $70.9 million after depositing $64.8 million and pocket the difference.
Summer Finance acknowledged the reported exploit and they are currently in the midst of finding out the root cause. Notably, the protocol guardians have currently paused all the vaults across the Lazy Summer Protocol, and the team will share more updates as and when they are unearthed.
DeFi’s exploit season rages on
Although data shows that DeFi protocols are becoming increasingly resilient, with the volume of exploits losses sliding 74 percent from their 2022 peak, 2026 has already seen several high-profile DeFi attacks that have raised serious concerns in the space.
On June 1, DeFi lending protocol Radiant Capital announced that it was shuttering its business following a massive $50 million exploit. Successive DeFi exploits are also having a negative cascading effect on ether and other altcoins.
That said, institutions still hold a bullish stance toward the emerging space. On June 24, banking giant Standard Chartered remarked that it is long-term bullish on DeFi protocol Aave amid tokenization expansion.
