Summer Finance (Lazy Summer Protocol)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5yYqQs…73pQSummary
Summer.fi (formerly Oasis.app) was a multi-protocol DeFi yield platform that launched the Lazy Summer Protocol in 2025 as an AI-powered automated yield optimizer. On July 6, 2026, an attacker exploited a vault NAV accounting flaw to extract approximately $6.04 million from Ethereum-based USDC vaults, routing stolen funds through Tornado Cash. The exploit led the Summer.fi Labs company to announce a wind-down of operations by August 31, 2026, with the Lazy Summer DAO retaining custody of on-chain vault contracts for ongoing user withdrawals.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(11 events)
1 January 2018
Chris Bradbury joins the Maker Foundation as product manager, begins work on Oasis.app as a frontend for MakerDAO.
Binance Feed interview with Chris Bradbury1 June 2021
Oasis.app spun out as an independent entity following Maker Foundation decentralization; Chris Bradbury becomes CEO.
Binance Feed interview with Chris Bradbury1 June 2023
Oasis.app rebrands to Summer.fi to reflect multi-protocol DeFi expansion.
Binance Feed interview with Chris Bradbury1 November 2025
Stream Finance discloses a $93 million loss; its xUSD token crashes 77%, leaving Silo Varlamore vault tokens with stale on-chain valuations that persist for months.
$6M Lazy Summer Exploit Traces Back to November's Stream Finance Collapse — CryptoTimes21 January 2026
SUMR token becomes transferable and begins trading on Aerodrome Ignition on Base.
Aerodrome Ignition X Space Recap — Summer.fi blog1 March 2026
Attacker begins accumulating mispriced Silo Varlamore tokens and funding exploit wallets, approximately three months before the attack.
BA Labs Risk Curator Retrospective — Summer Community Forum6 July 2026
Attacker uses a ~$65 million flash loan to manipulate NAV accounting in two Lazy Summer USDC vaults, extracting approximately $6.04 million in a single atomic transaction lasting approximately 36 seconds. Blockaid first alerts; BA Labs confirms at 05:44 UTC. Guardian Multisig pauses deposits by 06:37 UTC. Stolen funds subsequently routed through Tornado Cash.
CoinDesk; BA Labs Risk Curator Retrospective6 July 2026
SUMR token drops over 18% following exploit announcement; all Lazy Summer vaults paused across Ethereum, Base, Arbitrum, and Sonic networks.
Summer.fi $6M Exploit Freezes Lazy Summer Vaults — Phemex8 July 2026
Connection between exploit and the November 2025 Stream Finance collapse publicly reported.
$6M Lazy Summer Exploit Traces Back to November's Stream Finance Collapse — CryptoTimes20 July 2026
Summer.fi announces wind-down of the Labs company; app to remain live through August 31, 2026. BA Labs resigns as risk curator for the Lazy Summer Protocol.
SummerFi DeFi Shutdown — The Cryptonomist; BA Labs stepping down post — Summer Forum31 August 2026
Summer.fi application officially ceases operations; governance and vault infrastructure transfers to the Lazy Summer DAO. All Lazy Summer Vaults confirmed available for withdrawal.
All Lazy Summer Vaults are now available for withdrawal — Summer.fi blogDecision Log
- hash: FJEopQu1c97J5HuCfuuXgdsbhEC8Q9my14azTqykvfnM
This investigation is cryptographically anchored to the Solana blockchain (1 event). 17 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/27/2026, 12:07:50 PM
last updated: 9/27/2026, 1:37:24 PM
avoid.net — verified advice for a post-truth world