Summer.fi attacker launders $6.04 million exploit proceeds through Tornado Cash

The wallet behind the July 6 Summer.fi exploit has begun laundering the roughly $6.04 million in stolen funds through Tornado Cash after converting about 6.017 million DAI, swapped from the originally stolen USDC, into ETH and moving it in batches of 10 ETH or more. The attack hit two USDC vaults in the Lazy Summer Protocol, which Summer.fi serves as a front-end for, with the lower-risk vault losing about $5.64 million and the higher-risk vault losing about $0.40 million. Summer.fi said the breach stemmed from an operational failure tied to an incompletely offboarded strategy adapter, or Ark, connected to Silo “Varlamore USDC Growth” tokens, rather than a fundamental smart contract flaw. The attacker used roughly $65 million in flash loans to amplify manipulated net asset value calculations after pre-positioning overvalued Silo tokens in the still-active adapter. Security firms PeckShield and CertiK flagged the exploit, while Summer.fi paused all vault activity. SUMR fell to about $0.00193, down more than 5%, and the use of Tornado Cash is likely to make asset recovery significantly harder.