The attacker behind the Summer.fi exploit has moved the majority of stolen funds out of the wallet that originally received them, shifting attention from the initial breach to the more difficult questions of traceability and recovery. The transfers represent the most significant post-exploit development since the DeFi protocol halted its affected vaults.

Summer.fi, the rebranded successor to Oasis.app — MakerDAO's long-standing collateralized borrowing front-end — disclosed the incident earlier this month, when its Lazy Summer vaults were drained in an exploit that the protocol subsequently detailed in a post-mortem. The team paused the affected vaults while assessing the extent of the damage, a standard emergency response in DeFi where circuit-breaker mechanisms are often the last line of defense against ongoing drainage.

The scale of the breach was estimated at roughly $6 million when Summer.fi first halted the vaults, as reported by CoinDesk. Blockchain security firm PeckShield had earlier flagged the loss, reporting that Summer.fi was hacked for 6 million DAI — the decentralized stablecoin issued by the MakerDAO protocol on which Summer.fi's architecture depends.

Why the Exploiter's Transfers Change the Recovery Picture

The latest movement is significant because what happens to stolen assets after an exploit often determines whether any portion can be frozen or returned. Once funds leave the initial receiving wallet and begin passing through additional transaction hops, tracing them becomes materially harder.

The exploiter's wallet activity can be followed directly on the Ethereum block explorer, which records transfers, timestamps, and counterparties. On-chain visibility does not guarantee recovery, but it keeps the movement of assets in public view for analysts and the protocol.

Subsequent steps have already complicated that picture, with reporting indicating that the Summer.fi exploiter moved and mixed the stolen DAI. Mixing is typically the stage at which recovery odds fall sharply, because it breaks the direct link between source and destination addresses.

What the Incident Signals for DeFi Security

An exploit that drains user-facing vaults is a smart-contract and platform-risk event, not a market one, and the aftermath is where protocol trust is tested. How Summer.fi communicates and remediates carries as much weight for users as the original loss.

Summer.fi has framed its response around explaining what happened and outlining next steps in its post-mortem — the standard playbook for a protocol attempting to retain user confidence after a breach. Whether the majority of the funds that have now moved can be recovered remains unresolved.

On-chain analysts flagged the wallet movements as they occurred:

Tracking the Summer.fi exploiter's wallet as funds are moved on-chain. https://x.com/OnchainLens/status/2079851179367141885

— Onchain Lens (@OnchainLens) July 2026

Source: @OnchainLens on X