Woofun AI reports that Summer.fi’s Ethereum-based yield farming platform was compromised, resulting in the immediate suspension of its ‘Lazy Summer’ vaults to contain a breach involving USDC assets.

The attack vector relied on a large-scale flash loan sourced through the decentralized lending protocol Morpho, which allowed the attacker to borrow funds without collateral within a single transaction. By manipulating the accounting logic of the automated USDC vaults, the exploit targeted internal calculations to drain approximately $6 million before the transaction concluded.

Woofun AI data shows. Market reaction was swift, with the governance token SUMR plummeting by over 18% in the hours following the disclosure. This sharp decline reflects immediate concern among DeFi investors regarding smart contract vulnerabilities and the potential for further financial losses within the protocol.

Structurally, this incident underscores the persistent risk of logic-based flaws in yield-optimizing vaults, which are frequently weaponized via flash loans to exploit accounting discrepancies or oracle manipulation. While flash loans serve legitimate functions, their use in such attacks highlights the critical need for rigorous security audits before users deposit funds.

The protocol’s decision to pause vaults may limit further damage, but the incident has already eroded trust and triggered a significant sell-off. As investigations proceed, the community awaits a post-mortem report and details on user compensation to assess the long-term impact on platform credibility.