Cozy Finance was exploited on Optimism on Monday, with roughly $170,000 drained from the protocol. Blockchain security firm Blockaid flagged the attack, and the attacker moved the stolen funds off-chain within 13 minutes. The exploit hit nearly the entire Optimism-side balance of the protocol, which holds about $1.3 million across all chains.
How the drain worked
The exploit transaction hit at 05:43 UTC on September 7. The attacker moved approximately 163,326 USDC.e out of the protocol across 63 token transfers, and the same transaction burned roughly 1.6 million Cozy PToken (CPT). By 05:56 UTC, the attacker had approved a token and pushed funds through a bridge.
The attack contract went live on September 2, five days before the drain. The wallet drew its first funds from a Relay solver. The abused token contract, Cozy Set (CSET), remains unverified and still holds about $4,168 in USDC.e.
A second Optimism hit
This is the second exploit on Optimism. An earlier attack in August 2025 cost approximately $427,000, and that flaw was in the withdrawal code, which never checked who completed a redemption. Cozy Finance ranks fifth among insurance protocols on DefiLlama, holding about $1.3 million. DefiLlama listed roughly $172,000 on the Optimism side, so the attacker swept close to the entire deployment there.
Wider DeFi losses
Other recent incidents include Notional Finance losing $1.73 million to an integer overflow bug, Full Sail winding down after a $91,000 attack, and roughly $320 million in Bitcoin leaving Liquid Network with white hat claims. Blockaid first sized an August Flow exploit at $9.3 million before the network put the damage near $410,000.
The CSET contract still holds a small amount of USDC.e, and the attack contract had been live for five days before the drain. That gap suggests the attacker spent time preparing, but the protocol hasn't yet said whether it will reimburse users.
