Summer.fi Hacker Moves $1.35M Into Tornado Cash

The attacker behind the $6 million Summer.fi exploit has begun laundering the stolen funds, moving roughly $1.35 million in $DAI through Tornado Cash, the sanctioned crypto mixer, according to Summer.fi's own post-mortem of the July 6 attack.

Summer.fi, the front-end for the Lazy Summer Protocol, said the attacker "swapped a portion of the proceeds and routed them through Tornado Cash... via an intermediary wallet (0x46e0…eBa7)," adding that the move "signals limited intent to return the funds voluntarily."

Laundering Trail

Onchain Lens via Odaily, reported the exploiter's wallet received 6.017 million $DAI from the attack and has since moved 1.35 million $DAI, swapping it for $ETH on Uniswap before sending it through the same intermediary wallet into Tornado Cash. The original wallet still holds about 4.67 million $DAI, while the intermediary wallet holds 50 $ETH, per the report.

The exploit itself drained roughly $6.04 million from two Lazy Summer USDC vaults on Ethereum on July 6, after an attacker manipulated vault share pricing using a stale-valued token position built up over three months, Summer.fi said. The Defiant previously covered the initial exploit.

Summer.fi said its security partners, including SEAL 911, are continuing to trace the funds but that tracing "breaks down" once assets are swapped out of stablecoins and deposited into a mixer. The protocol publicly named the attacker's funder and beneficiary wallet, 0x7BF7…BDCa, "so the community and exchanges can flag associated activity."

Roughly 4.67 million $DAI of the original haul remains untouched in the exploiter's primary wallet, leaving open whether further funds will move through Tornado Cash.