→ Actions taken as of the time of writing
→ List of services the attacker interacted with
→ Timeline of events
→ Analyst notes
→ Incident conclusion
→ Attacker addresses
→ Transactions affiliated with the exploit

Get advice from AML Crypto experts

On July 6, 2026, at 05:17:59 UTC, the attacker executed a single atomic transaction on the Ethereum network, as a result of which two USDC vaults of the Lazy Summer Protocol - Lower Risk and Higher Risk - lost approximately $6.04 million of depositors' funds. The attacker artificially inflated the value of the vault shares using overvalued Silo Varlamore tokens and then drained real liquidity from the protocol's other positions.

The AML Crypto team reconstructed the movement of the stolen funds in Bholder.

https://bholder.amlcrypto.io/shared/699acc2f35864dcc8fb873cb89d4d24c

Victim:

Lazy Summer Protocol (Summer.Fi platform)
Background:

Summer.fi is a DeFi platform that by 2026 had focused on developing the Lazy Summer Protocol - an onchain protocol of automated yield vaults. Users deposit assets, such as USDC, into so-called Lazy Vaults, after which the protocol allocates liquidity across pre-approved DeFi strategies and, when necessary, rebalances positions to generate yield in line with a defined risk level. The individual capital allocation destinations within the system are called ARKs.

Previously, Summer.fi also offered the Summer.fi Pro service for lending, borrowing, and managing positions in third-party protocols. However, as of February 12, 2026, that interface was switched to view-only mode, and management of such positions was migrated to DeFi Saver. Since then, the Lazy Summer Protocol has become Summer.fi's core product.
Incident date:

2026-07-06 05:17:59 UTC
Incident summary:

The attacker took advantage of the fact that one of the investment modules being decommissioned - an Ark - was still included in the value calculation of two Lazy Summer USDC vaults.

The attacker had purchased in advance nearly worthless Silo Varlamore tokens, which the system continued to value significantly above their real worth. He then took out a flash loan of approximately $65 million, deposited USDC into the vaults, and transferred the overvalued tokens directly into the problematic Ark. As a result, the protocol mistakenly concluded that the value of the vault's assets had risen sharply, and the price of its shares increased accordingly.

The attacker then redeemed his shares at the artificially inflated price. The payout was made not in the problematic tokens but in genuine liquid USDC belonging to depositors. Having received the funds, the attacker repaid the flash loan and kept approximately $6.04 million in profit. The entire operation affected two USDC vaults and was executed within a single transaction.

Actions taken as of the time of writing

As of July 10, 2026, the following measures had been taken after the attack:

The attacker's addresses were labeled in blockchain analytics systems. AML Crypto also identified and labeled the attacker's main address, the contract used to carry out the attack, and the addresses associated with them.
Information about the addresses was submitted to IDM. Details of the attacker's addresses and related transactions were sent to the system for further monitoring and response.
New deposits into the affected vaults were halted. Approximately an hour and a half after the attack, Block Analitica set zero deposit caps on the two affected USDC vaults.
Operation of the Lazy Summer Protocol vaults was suspended. The Guardian Multisig paused the vaults on the Ethereum, Base, Arbitrum, and Sonic networks to rule out a repeat of the attack through a similar Ark configuration. On HyperEVM, the pause via the Guardian did not go through due to the absence of the required role, but deposit caps there had already been set to zero.
SEAL 911 was brought into the investigation. Specialists began working with Summer.fi to analyze the attack mechanics and trace the origin of the funds used by the attacker. Blockaid, CertiK, PeckShield, Cyvers, and other teams also participated in or assisted with the investigation and tracing.
An attempt was made to contact the attacker. An onchain message was sent to the attacker from the Lazy Summer Protocol deployer address offering to establish contact. There is no public confirmation of a response from the attacker.
The overvalued tokens were removed from the vault value calculation. The Lazy Summer Foundation transferred the Silo Varlamore tokens from the Lower-Risk USDC Vault to its multisig. This eliminated the artificial distortion of the displayed asset value and share price.
Tracking of the stolen funds continued. The attacker's address and the exploit contract were published so that exchanges, analytics services, and other market participants could flag related activity. Meanwhile, part of the funds was moved through an intermediary address into Tornado Cash, which significantly complicated further onchain tracing.
Users were notified via the Summer.fi interface. The interface displayed information about the protocol suspension and the incident status. The team also stated that the internal technical investigation was ongoing, the root cause of the attack was being confirmed, and data was being prepared for DAO decisions.
The DAO began considering next steps. The items put up for discussion included the conditions for resuming operation of the unaffected vaults, the procedure for returning the remaining capital to users, and the possible exclusion of the attacker's shares from future calculations. At the time of publication, no final decision on compensation had been made.

Communication with the attacker:

Information related to the exploit of the USDC Vault on the Lazy Summer Protocol Jul-6-2026 05:17 UTC. This is the Summer deployer address. Can we discuss over Blockscan Chat. [link]

List of services the attacker interacted with

Stargate

Nature of the connection:

direct, with the second address involved in laundering the stolen funds.
Reason for the request:

every Stargate cross-chain operation is linked to a transaction on the source network and a payout transaction on the destination network. In addition, the Stargate interface allows the user to specify an arbitrary recipient address. Accordingly, information about the relevant operations may make it possible to establish the source blockchain network, the wallet address from which the funds were deposited, the source TxIDs, the LayerZero GUID, the user-specified recipient address, and a possible refund address. We also request information about other operations linked to the same source address and any available technical details about the initiator of the transfers.
Contact:

notices@stargate.finance. This address is specified in Stargate's official Terms of Use for legally significant notices and requests.

Uniswap

Nature of the connection:

direct, with both addresses involved in the exploit.
Reason for the request:

the identified transactions may have been initiated through the official Uniswap web interface, Uniswap Wallet, or the Uniswap Labs API. According to the Privacy Policy, when a non-custodial wallet is connected, Uniswap Labs records the wallet's public address and may collect limited technical information, including localStorage data, mobile device ID, cookies, browser type and version, operating system, device or browser language, and referring/exit pages.
Contacts:

Official and legal requests: legal@uniswap.org
Support requests: support@uniswap.org
Data storage and processing inquiries: privacy@uniswap.org
Request form: https://support.uniswap.org/hc/en-us/requests/new
Mailing address: Universal Navigation, Inc., 228 Park Ave S, PMB 44753, New York, NY 10003, USA.

Curve Fi

Nature of the connection:

direct, with one of the addresses involved in the exploit and with an address used in laundering the stolen funds.
Reason for the request:

the identified operations may have been initiated through the official Curve Finance web interface. According to Curve's current Privacy Policy, use of the site may involve the collection of the IP address, information about the device's operating system, cookies, referrer URL, volume of data transferred, pages visited, browser type and version, internet service provider, protocols used, and other technical information.
Contacts:

enquiries@curve.fi — the primary address specified in Curve's current Terms and Privacy Policy for official requests and data processing inquiries.
security@curve.finance — the official contact for security matters and urgent incident escalation.

FixedFloat

Nature of the connection:

direct. The FixedFloat hot wallet 0xba3fe475f4617944c6e56d33cd7c2a841aaa8bca provided liquidity on the Base network to the addresses 0x34b5f9478fc7bc8c3f065d940afd5cae1890387b and 0x5864a889076b9b4d2929f2e7b990c8076eea3c3c, presumably controlled by the attacker. The funds received were subsequently sent to Gas.zip and used to fund the fees of the addresses involved in preparing and carrying out the Lazy Summer Protocol exploit.
Reason for the request:

according to its Privacy Policy, FixedFloat automatically collects the IP address, browser type, internet service provider, referring/exit pages, date and time of visit, cookies, log files, tags, and pixels. We therefore also request IP addresses, timestamps, browser and ISP data, cookie and session identifiers, device information, support request history, and information about other orders linked to the same technical identifiers, addresses, or contact details.
Contacts:

legal@fixedfloat.com — law enforcement requests;
compliance@fixedfloat.com — AML/compliance matters and suspended transactions;
help@fixedfloat.com — requests from crime victims;
support@fixedfloat.com — general inquiries and support.

Gaz Zip

Nature of the connection:

direct. The addresses 0x34b5f9478fc7bc8c3f065d940afd5cae1890387b and 0x5864a889076b9b4d2929f2e7b990c8076eea3c3c, presumably controlled by the attacker, sent ETH to the Gas.zip deposit address 0x2a37D63EAdFe4b4682a3c28C1c2cD4F109Cc2762. After the deposits were processed, the Gas.zip hot wallet 0x5babe600b9fcd5fb7b66c0611bf4896d967b23a1 transferred ETH to five addresses used to accumulate Silo Varlamore tokens: 0xd39d1733a03f940ce47cec8982e45e6964d29fa1 0xe5bff5a3752d48606d5f4ff19954138fe5e656b1 0x11946f3bb1e67b8f4e50cb01ea1fba7cec7ac60e 0x14ec7a28c020283eb53f302e8dbcc025cb49baf8 0x341a58a1ad7aa1fee212719b0c2d8e4c8e0fd195 The accumulated tokens were subsequently transferred to the exploit contract 0x0514f827c129c16418a0933e03c99a6af982fc61 and used in the exploitation of the Lazy Summer Protocol.
Reason for the request:

the Gas.zip service was used to distribute funds to addresses directly involved in preparing the exploit. According to Gas.zip's technical documentation, a deposit transaction contains calldata specifying the destination networks and the recipient address, and the recipient address may differ from the address that made the deposit. Consequently, Gas.zip's internal data may make it possible to match incoming deposits with outgoing payouts, identify the networks and destination addresses selected by the user, and reveal other operations performed by the same initiator.
Contact for official requests:

privacy@gas.zip - the official address for requests concerning personal data and technical information.

Timeline of events

Stage 0: Accumulation of Silo Varlamore tokens

2026-03-30 9:31:23

withdrawal of Silo Varlamore tokens (accumulation) to the address 0x11946f3bb1e67b8f4e50cb01ea1fba7cec7ac60e

from 2026-03-30 2:39:35 to 2026-03-30 3:59:35

withdrawal of Silo Varlamore tokens (accumulation) to the address 0x14ec7a28c020283eb53f302e8dbcc025cb49baf8

2026-04-09 4:06:35

withdrawal of Silo Varlamore tokens (accumulation) to the address 0xe5bff5a3752d48606d5f4ff19954138fe5e656b1

2026-04-09 4:18:11

withdrawal of Silo Varlamore tokens (accumulation) to the address 0xd39d1733a03f940ce47cec8982e45e6964d29fa1

2026-04-09 12:00:11

withdrawal of Silo Varlamore tokens (accumulation) to the address 0x341a58a1ad7aa1fee212719b0c2d8e4c8e0fd195

Stage 1: Withdrawal of funds from FixedFloat to pay fees and carry out the exploit

2026-04-06 15:43:35

withdrawal of funds from the FixedFloat hot wallet to the attacker's affiliated address

2026-04-06 15:46:25