Drift

DeFi

Summer

Flash

Million

Summer Finance has become the latest decentralized finance protocol to suffer a major security incident. So far, $6 million has been drained in the ongoing exploit, according to blockchain security firm Blockaid.
However, the project has yet to release an official statement.
<h2 id="flash-loan-attack">Flash Loan Attack</h2>
Pseudonymous crypto trader Crypto Jargon said the attacker borrowed the funds through a flash loan, manipulated liquidity across Curve’s DAI/USDC pools and Morpho, extracted about $6 million in profit, and repaid the loan within the same transaction. The trader said that flash loan attacks remain difficult to prevent and <a href="https://x.com/Crypto_Jargon/status/2074025059224830270" rel="noopener noreferrer nofollow">explained</a>,
<blockquote>
 “The attacker doesn’t need to own the money they’re manipulating with; they borrow $65M for a few seconds, temporarily distort a price or liquidity ratio, extract the difference, and return the loan before the transaction even finalizes. If any single step reverts, the whole thing undoes itself, so they only ever risk gas fees.”
</blockquote>
Phylax Systems founder Odysseas Lamtzidis also <a href="https://x.com/odysseas_eth/status/2074031335002222618" rel="noopener noreferrer nofollow">shared</a> a technical analysis, suggesting that the exploit was caused by flaws in Summer Finance’s same-transaction vault accounting and liquidity assumptions, rather than compromised keys or abuse of admin privileges. He added that the attacker used an unverified contract to orchestrate the exploit, while the vulnerable protocol components themselves were verified.
<h2 id="2026-defi-losses">2026 DeFi Losses</h2>
The incident comes amid a sharp rise in attacks targeting DeFi protocols this year. According to crypto market tracker CryptoRank, the sector has <a href="https://cryptopotato.com/report-q2-2026-becomes-worst-quarter-ever-for-crypto-hacks/" rel="noopener noreferrer nofollow">recorded</a> 121 DeFi hacks in 2026, which resulted in almost $942 million in losses.
Most of this year’s attacks happened in the second quarter, when hackers carried out 85 exploits and stole around $775 million. CryptoRank found that DeFi’s total value locked (TVL) has declined every month this year after falling from about $115 billion in January to $70 billion by late June as investor confidence weakened.
While Q2 recorded the highest number of exploits, the firm said most losses stemmed from two major attacks in April. Drift Protocol and KelpDAO together lost about $590 million, which represented more than half of all DeFi losses this year.
TRM Labs and Chainalysis <a href="https://cryptopotato.com/kelpdao-and-drift-lead-devastating-650m-crypto-hack-wave-of-april/" rel="noopener noreferrer nofollow">linked</a> both attacks to North Korea-backed hacking groups. Their investigations found that the attackers used social engineering, compromised infrastructure, and manipulated cross-chain verification systems to carry out the large-scale thefts.
The post <a href="https://cryptopotato.com/6-million-gone-summer-finance-hit-by-sophisticated-flash-loan-liquidity-manipulation/" rel="noopener noreferrer nofollow">$6 Million Gone: Summer Finance Hit by Sophisticated Flash Loan Liquidity Manipulation</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

$6 Million Gone: Summer Finance Hit by Sophisticated Flash Loan Liquidity Manipulation

Table of Contents

CryptoPotato_News

Other articles published on Jul 6, 2026

Join our free newsletter for daily crypto updates!