Cozy Finance Exploit Drains $170,000 From DeFi Insurer for Second Time

Blockchain security firm Blockaid reported that an attacker siphoned roughly $170,000 from Cozy Finance on the Optimism network early Monday. The funds were moved out of the protocol and bridged to another chain within 13 minutes.

Attack Details

The exploit transaction was recorded at 05:43 UTC on Monday on the Optimism mainnet explorer. It transferred about 163,326 USDC.e across 63 token transfers and burned approximately 1.6 million Cozy PToken (CPT). At 05:56 UTC the attacker approved a token and sent the funds through a bridge, completing the exit before Blockaid’s alert was published. No further activity has been observed from the attacker’s wallet.

Preparation and Vulnerable Contracts

Analysis shows the malicious contract was deployed on September 2, five days before the drain. The attacker initially funded the contract via a Relay solver. Blockaid identified the token contract Cozy Set (CSET) as the abused contract; it remains unverified and still holds about $4,168 in USDC.e.

Historical Context

This is not Cozy Finance’s first loss on Optimism. In August 2025 an attacker extracted roughly $427,000, exploiting a flaw in the withdrawal code that failed to verify the redeemer. At the time, security firm Verichains highlighted the issue.

Impact on the Protocol

Cozy Finance ranks fifth among insurance protocols on DefiLlama, with total assets of about $1.3 million. Approximately $172,000 of those assets were deployed on Optimism, meaning the recent attack likely swept most of the protocol’s Optimism deployment.

Broader DeFi Security Landscape

Similar exploits continue to affect DeFi projects. Notional Finance recently lost $1.73 million due to an integer overflow bug, and Full Sail suffered a $91,000 theft before winding down operations. Larger incidents, such as a $320 million Bitcoin outflow from the Liquid Network, also underscore ongoing security challenges.