Summer.fi vault theft takes US$6.04 million; remaining USDC made claimable as company winds down
An attacker stole about US$6.04 million from two Summer.fi Ethereum USDC vaults. Remaining funds are claimable through Merkl; full reimbursement is unconfirmed. Other vaults reopened for withdrawals, while new deposits remain blocked.
If you held funds in either affected Ethereum USDC vault, use the same wallet to check your remaining-USDC distribution at app.merkl.xyz/users. For other Lazy Summer vaults, use Summer.fi's exit interface to withdraw remaining positions and claim rewards. The affected vaults' distribution is not confirmation that your original deposit has been repaid in full.
What’s happening
On 6 July 2026, an attacker stole approximately US$6.04 million from the Lower Risk and Higher Risk USDC vaults in Summer.fi's Lazy Summer Protocol on Ethereum. An investment position being retired still contributed an outdated, inflated valuation to vault prices. Summer.fi described this as an operational failure, rather than stolen administrator keys or a vault contract coding bug. Deposits and withdrawals were suspended during the response. The company announced a wind-down on 15 July after losing some of its own capital. On 30 July, it confirmed that unaffected vaults had reopened for withdrawals following cleanup, with deposits still blocked. Affected depositors could claim the two exploited vaults' remaining USDC through Merkl. This distribution returned residual funds; it did not establish repayment of the stolen money. Recovery of the stolen funds and full reimbursement remain unconfirmed in the sources reviewed. Summer.fi's current site describes the protocol as withdrawal-only.
- What
- Breach
- Affects
- Summer.fi Lazy Summer Protocol Ethereum USDC vaults
- Fixed in
- Nothing to patch
- Since
- 6 July 2026
- Closed
- 30 July 2026
Timeline
- Update
Summer.fi confirmed withdrawals had reopened for unaffected vaults after dormant strategies were removed; deposits remained blocked. Remaining USDC from the two exploited vaults was available through a separate Merkl distribution, rather than ordinary vault withdrawals.
- Update
Summer.fi announced it would wind down operations. It said team capital lost in the affected vaults had removed the funds needed to rebuild; the independently governed Lazy Summer DAO would determine the protocol's future.
- Update
Summer.fi reported that some proceeds had passed through Tornado Cash and tracing continued with security partners. Compensation remained undecided, with roughly US$4 million still in illiquid vault positions.
- Made publicNothing to patch
An attacker manipulated valuations in Lazy Summer's Lower Risk and Higher Risk USDC vaults on Ethereum, taking approximately US$6.04 million of depositor funds.
- Update
Block Analitica blocked deposits to the affected vaults at 06:42 UTC. Guardians subsequently paused vaults across Ethereum, Base, Arbitrum and Sonic, disabling withdrawals during the response.
Sources
- [RECAP] Community Call #16: July 6 Incident Review, Community Q&A & Next StepsSummer.fi · 10 July 2026
- Sunsetting Summer.fi and the Labs CompanySummer.fi · 15 July 2026
- All Lazy Summer Vaults are now available for withdrawalSummer.fi · 30 July 2026
- Summer.fi withdrawal and rewards interfaceSummer.fi
- ~$36M Lost: Summer.fi, Bonzo Lend & More | BlockSec WeeklyBlockSec · 15 July 2026
- $6 Million Vault Exploit Forces DeFi Platform Summer.fi to Wind DownBeInCrypto · 16 July 2026