Cozy Finance exploited on Optimism; $170,000 drained

Cozy Finance, a decentralized insurance protocol, was exploited on Optimism early Monday when an attacker removed roughly $170,000 and moved the funds across a bridge within 13 minutes, according to security firm Blockaid. On-chain records show the exploit transaction hit at 05:43 UTC and transferred about 163,326 USDC.e across 63 token movements.

The transaction also burned approximately 1.6 million Cozy PToken (CPT) and included an approval step before the assets exited via a bridge at 05:56 UTC. Blockchain explorers show no further activity from the attacker’s wallet after the bridge transfer.

Records indicate the exploit contract was deployed on Sept. 2, five days before the drain, and that the attacker’s wallet sourced initial funds from a Relay solver. Blockaid identified the Cozy Set (CSET) token contract as the abused contract; that contract remains unverified on-chain and still holds about $4,168 in USDC.e.

Cozy operates protection markets that sell coverage against DeFi failures and holds roughly $1.3 million in total value locked, ranking fifth among insurance protocols on DefiLlama. About $172,000 of that TVL was on Optimism, indicating the attacker removed nearly the protocol’s entire deployment on that chain.

Cozy experienced a prior Optimism loss in August 2025 when an exploit removed about $427,000 after a redemption routine failed to verify who completed withdrawals.

The incident follows several recent DeFi losses, including a $1.73 million integer overflow at one protocol and an attacker extraction of about $91,000 at another project. Early loss estimates can change as investigators audit transaction flows; a previous exploit initially sized at $9.3 million was later reassessed near $410,000.

Blockaid is continuing to trace the funds and said it will publish updates as analysis proceeds. The firm posted: “Blockaid detected an ongoing exploit on @cozyfinance on Optimism. 170k$ drained so far.”

Cozy users and protocol maintainers are reviewing exposure across chains and assessing whether remaining contracts require verification or emergency fixes.