Summer.fi to Wind Down After $6.04M Ethereum Exploit Tied to Oracle Manipulation

Summer.fi has confirmed it is shutting down following a major security breach that drained roughly $6.04 million from the Lazy Summer Protocol's Ethereum-based vaults. The incident, which occurred on July 6, hit two USDC vaults. Summer.fi said the losses depleted its operating runway, leaving no viable path to restructure. The closure also ends Summer.fi Labs. Existing users will still be able to access the frontend to manage assets until August 31. Official support via email and Discord will remain available through the end of August. The team attributed the exploit to manipulation of pricing for two USDC vault shares. It said the attacker combined a registered PriceUpKeep forwarder with future-dated authorized oracle reports to manufacture artificial trading profits. Security firm Blockaid connected the broader technique to an earlier pattern it observed, where manipulated pricing data led to an estimated $18 million USDC payout from a vault after the altered oracle inputs were accepted. In a separate disclosure, Blockaid said it detected an @Ostium vault exploit on Arbitrum involving the same elements: a registered PriceUpKeep forwarder and future-dated authorized oracle reports that triggered a ~$18M USDC payout. With Summer.fi winding down, governance and recovery efforts move to the Lazy Summer DAO. The DAO said it is working to restore full withdrawal and redemption functionality for affected vault users and will handle remaining technical and governance decisions as the recovery process progresses. Disclaimer: This content is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should conduct their own research before making financial decisions.