$6 Million Stolen from Summer.fi, Laundered Through Sanctioned Mixer

A hacker exploited Summer.fi's Ethereum-based yield farming platform yesterday, draining approximately $6 million in DAI (a stablecoin pegged to the US dollar) from the protocol. The attacker then began laundering the funds through Tornado Cash, a cryptocurrency mixing service sanctioned by the U.S. Treasury in 2022.

The hacker's method involves splitting the stolen assets into smaller amounts, swapping them for Ether (ETH) on Uniswap, and routing the ETH through an intermediary wallet before depositing it into Tornado Cash in increments of 10 ETH. So far, around $71,750 worth of ETH has been processed through the mixing service.

This incident highlights persistent security vulnerabilities within the DeFi ecosystem, particularly for protocols handling large liquidity pools. The use of Tornado Cash indicates the attacker's intent to bypass regulatory and blockchain surveillance, making recovery efforts challenging.