The hacker behind the $6.04 million Summer.fi exploit on July 6 has begun laundering stolen funds through Tornado Cash, converting the haul from stablecoins to ETH and sending it through the privacy mixer in chunks.
Approximately 6.017 million DAI, swapped from the originally stolen USDC, was converted into ETH and routed through Tornado Cash in batches of 10 ETH or larger. Tracing firms are actively monitoring the laundering activity, but the use of Tornado Cash complicates recovery efforts considerably.
How the exploit actually worked
The attack targeted two USDC vaults within the Lazy Summer Protocol, which Summer.fi serves as a front-end for. The lower-risk vault, LazyVault_LowerRisk_USDC, bore the brunt of the damage at $5.64 million stolen. The higher-risk vault lost a comparatively modest $0.40 million.
The attacker borrowed roughly $65 million in flash loans to execute the operation, but the actual vulnerability was far more mundane.
