Cozy Finance Exploit Drains $170,000 From DeFi Insurer for a 2nd Time

Blockchain security firm Blockaid flagged a Cozy Finance exploit on Optimism early Monday. The attacker drained roughly $170,000 and bridged the funds out within 13 minutes.

Cozy Finance runs protection markets that let users buy cover against DeFi failures. An earlier Optimism attack cost the protocol about $427,000 in August 2025.

Attacker Bridged the Money Out in 13 Minutes

The exploit transaction landed at 05:43 UTC on Monday, according to OP Mainnet explorer data. It moved about 163,326 USDC.e out of the protocol across 63 token transfers.

Meanwhile, the same transaction burned roughly 1.6 million Cozy PToken (CPT). The attacker then approved a token and pushed the funds through a bridge at 05:56 UTC.

That exit came before Blockaid published its alert. Explorer records show no further movement from the wallet since.

The attacker also prepared well ahead. Records show the attack contract went live on September 2, five days before the drain. The wallet drew its first funds from a Relay solver.

Blockaid also named Cozy Set (CSET) as the abused token contract. That contract remains unverified and still holds about $4,168 in USDC.e.

🚨Community alert:Blockaid detected an ongoing exploit on @cozyfinance on Optimism.170k$ drained so far.More details in 🧵

— Blockaid (@blockaid_) September 7, 2026

Cozy Finance Exploit Repeats a 2025 Failure

This is not the protocol’s first loss on Optimism. An attacker took about $427,000 in August 2025, security firm Verichains found.

The flaw sat in the withdrawal code, which never checked who completed a redemption. Cozy Finance now ranks fifth among insurance protocols on DefiLlama, holding about $1.3 million.

DefiLlama listed roughly $172,000 on the Optimism side. Therefore, the attacker appears to have swept close to the entire deployment there.

Similar raids keep landing across DeFi. Notional Finance lost $1.73 million last week to an integer overflow bug. Days earlier, Full Sail wound down operations after an attacker took roughly $91,000.

Monday brought a far larger case as well. Roughly $320 million in Bitcoin left the Liquid Network, and the actors claimed white hat intentions on-chain.

However, early loss figures often move. Blockaid first sized an August Flow exploit at $9.3 million before the network put the damage near $410,000.

Blockaid promised more detail as it traces the money. The sum is small, yet a second breach on the same chain raises harder questions.