Six million dollars in one transaction: reading a flash-loan vault exploit

On 6 July 2026, Summer.fi lost approximately $6.04 million from its Lazy Summer USDC vaults. The attacker never needed capital of their own. A flash loan supplied the liquidity, the vault's own accounting supplied the mispricing, and the whole thing settled inside a single atomic transaction.

What the attacker actually did

The shape is familiar once you have seen it. Borrow far more than you could ever hold, use that size to distort a valuation the protocol trusts, redeem against the distorted number, then hand the loan back before the transaction ends. Nothing is left outstanding, so nothing can be unwound.

• Large flash-loan acquisition: significant temporary liquidity obtained with no upfront capital
• Rapid contract interactions: borrowed capital routed through multiple protocol contracts in a compressed execution window
• Protocol state manipulation: the vault's accounting and valuation state shifted, changing the value represented by vault shares
• Value extraction: assets redeemed against the manipulated valuation at a price economically unfavourable to the protocol
• Flash-loan settlement: the borrowed liquidity repaid inside the same atomic transaction
• Profit extraction: remaining assets moved out to attacker-controlled addresses

A flash loan is not a finding

This is where a lot of monitoring goes wrong. Flash loans are ordinary DeFi infrastructure, used for arbitrage, liquidations, refinancing and liquidity management thousands of times without incident. Alerting on flash-loan size alone produces a queue no watch floor can work.

The risk appears in the combination: large temporary liquidity, plus abnormal protocol interaction, plus an economically significant state change, inside one execution path. Any of those alone is noise. Together they describe an exploit.

The signals that get correlated

• Abnormal flash-loan activity: unusually large temporary liquidity entering a transaction
• Rapid cross-contract interaction: multiple protocol interactions inside a highly compressed execution window
• Valuation anomalies: sudden, abnormal changes in asset, share, or collateral valuation
• Large asset movement: significant transfers immediately before or after a protocol state change
• Atomic attack patterns: the borrow, manipulate, extract, repay sequence inside one transaction
• Post-exploit fund movement: extracted assets moving toward attacker-controlled or previously unseen addresses

Reading the chain in order

Laid end to end the path is legible: flash loan, abnormal capital concentration, rapid protocol interaction, valuation or accounting anomaly, large redemption or extraction, loan repayment, then movement to attacker-controlled addresses. Each step on its own is unremarkable. The order is what indicts it.

What the incident should change

The lesson is that malicious behaviour may not be visible from any single transaction event. An attacker can fold a flash loan, several protocol interactions, temporary state manipulation, and rapid fund movement into one atomic execution path, and every component will resemble something a legitimate user does.

Detection therefore has to work at the level of relationships between events, not at the level of the event. That is the difference between a stream of isolated transactions and a described attack sequence a security team can act on.

This write-up is based on publicly available information about the Summer.fi incident. The detection behaviour described is how Chain Monitor is built to correlate this class of activity, and should not be read as a claim that Chain Monitor was deployed on Summer.fi at the time of the original incident.