Cozy Finance Hit Again, $170K Drained on Optimism

Blockchain security firm Blockaid detected an exploit targeting Cozy Finance on the Optimism network early Monday. The attacker managed to extract approximately $170,000 and moved the funds across a bridge within 13 minutes.

Cozy Finance operates protection markets that allow users to purchase coverage against failures in decentralized finance. An earlier attack on Optimism in August 2025 resulted in a loss of about $427,000 for the protocol.

Funds Bridged Out Within 13 Minutes

The exploit transaction occurred at 05:43 UTC on Monday, according to data from the OP Mainnet explorer. It involved moving roughly 163,326 USDC.e out of the protocol through 63 token transfers.

At the same time, the transaction burned around 1.6 million Cozy PToken (CPT). The attacker then approved a token and sent the funds through a bridge at 05:56 UTC.

The funds were moved before Blockaid published its alert. Explorer data shows no further activity from the wallet since then.

The attacker appears to have prepared in advance. Records indicate the attack contract was deployed on September 2, five days before the funds were taken. The wallet received its initial funding from a Relay solver.

Blockaid identified Cozy Set (CSET) as the token contract that was abused. That contract remains unverified and still holds about $4,168 in USDC.e.

🚨Community alert:
Blockaid detected an ongoing exploit on @cozyfinance on Optimism.
170k$ drained so far.

More details in 🧵

— Blockaid (@blockaid_) September 7, 2026

Cozy Finance Exploit Repeats a 2025 Failure

This is not the first time the protocol has suffered a loss on Optimism. An attacker stole roughly $427,000 in August 2025, according to security firm Verichains.

The flaw was located in the withdrawal code, which did not verify who completed a redemption. Cozy Finance now ranks fifth among insurance protocols on DefiLlama, with about $1.3 million in holdings.

DefiLlama showed roughly $172,000 on the Optimism side. That means the attacker appears to have taken nearly the entire deployment there.

Similar attacks continue to occur across DeFi. Notional Finance lost $1.73 million last week due to an integer overflow bug. Days earlier, Full Sail wound down operations after an attacker stole roughly $91,000.

Monday also saw a much larger case. About $320 million in Bitcoin left the Liquid Network, with the actors claiming white hat intentions on-chain.

Early loss estimates often change. Blockaid initially sized an August Flow exploit at $9.3 million before the network put the damage at around $410,000.

Blockaid said it would provide more details as it traces the funds. The amount is relatively small, but a second breach on the same chain raises more serious questions.