The scariest part of the @summerfinance_ exploit isn't the $6.04M drained on July 6. It's that the risk took 8 months to assemble, in plain sight, across four organizations. Oct 30, 2025: SiloV2 Ark cap set to zero. Offboarding begins. Nov 2025: Stream Finance collapses. Silo Varlamore tokens go stale on chain, never marked down. Apr 2026: attacker funds wallets, spends 3 months quietly accumulating the mispriced tokens. Jul 6, 2026: one atomic tx. 65.4M flash loan, 64.8M deposited, stale tokens donated into the still listed Ark, 70.9M redeemed. $5.64M from the Lower Risk USDC vault. $0.40M from the Higher Risk one. Curator @BlockAnalitica zeroed the caps 8 months early. Guardians paused within the hour. Governance owned delisting. Never finalized.Protocol owned totalAssets(). Kept counting the dead Ark. Everyone claims they did their job. The design did not. Audits cover code. Nothing covers the space between four organizations with no shared runbook. Be very careful allocating to Morpho or any protocol that relies on external curators. The model asks you to underwrite coordination risk between parties whose incentives are closer to BD than to risk management. This is why D2 runs on two venues only, @HyperliquidX and @DeriveXYZ. And we watch them closely. Counterparties don't add risk linearly. They multiply seams. Are you paid enough for the risk you're taking?