Summer.fi Got A Little Too Lazy For Its Own Good: $6M Reportedly Siphoned in Vault Exploit 🕳️

DeFi protocol Summer.fi, formerly known as Oasis.app, has reportedly been exploited for roughly $6 million, with blockchain security firm Blockaid flagging the incident on Monday. The firm published the attacker's address (0x7BF716167B48CF527725722C6d79494b45B3BDCa), the exploit contract (0x0514F827C129C16418a0933E03C99A6AF982FC61), and the three affected Lazy Summer contracts on X, crediting its detection system with surfacing the breach early Monday morning.

PeckShield identified the main affected vault as LazyVault_LowerRisk_USDC (LVUSDC), a strategy risk-managed by Block Analitica. According to the security firm, the vault's displayed APY briefly spiked to approximately 2.08 million %. "The largest current holder is 0x8741e8f…4130, which appears to be associated with Torben Jorgensen (UDHC), and has deposited ~8.6M USDC into this vault," PeckShield wrote. The three Summer.fi / Lazy Summer contracts flagged as affected are 0x98C49e13bf99D7CAd8069faa2A370933EC9EcF17, 0xA9ca4909700505585B1aD2a1579dA3b670FFA9c4, and 0xE9cDA459bED6dcfb8AC61CD8cE08E2D52370cB06.

Summer.fi serves as the front-end for the Lazy Summer Protocol, an onchain vault system that automatically routes deposits across DeFi yield sources including Aave and Morpho. The network's native token SUMR traded near $0.00193, down 5.3% over 24 hours, diverging from the broader crypto market, which rose more than 1% on the day, according to CoinGecko data.

The incident marked the second crypto exploit recorded in July, per DeFiLlama, and follows a string of attacks in June during which crypto platforms lost $75.87 million across 40 hacks, with the Humanity Protocol breach accounting for the largest single loss. BeInCrypto has reached out to Summer.fi for comment and will update as the situation develops.