Cozy Finance suffers second exploit, losing $170,000 on Optimism blockchain

DeFi insurance protocol Cozy Finance suffers its second exploit on the Optimism blockchain on September 7, 2026, losing approximately $170,000. Security firm Blockaid detects the attack, which targeted the unverified Cozy Set token contract. The attacker prepared five days in advance and bridged the stolen USDC.e out within 13 minutes. This breach follows a prior $427,000 exploit in August 2025, raising security concerns amid a wave of recent DeFi hacks.

Cozy Finance Optimism exploit

• ▪The September 7, 2026 exploit targeted the unverified Cozy Set token contract, which retained approximately $4,168 in USDC.e after the attack.
• ▪An attacker drained approximately $170,000 in USDC.e from Cozy Finance across 63 token transfers on September 7, 2026.
• ▪Blockchain security firm Blockaid flagged an exploit on DeFi insurance protocol Cozy Finance on the Optimism blockchain on September 7, 2026.

Attack execution timeline

• ▪The attacker's wallet for the September 7, 2026 Cozy Finance exploit drew its initial funding from a Relay solver.
• ▪The attacker prepared for the September 7, 2026 exploit by deploying the attack contract on September 2, 2026, five days before the drain.

Bridge fund movement

• ▪The exploit transaction on September 7, 2026 occurred at 05:43 UTC, burning approximately 1.6 million Cozy PToken.
• ▪The attacker approved a token and bridged the stolen Cozy Finance funds out of the Optimism blockchain at 05:56 UTC on September 7, 2026.

Withdrawal code vulnerability

• ▪The vulnerability in the August 2025 Cozy Finance exploit was located in the withdrawal code, which failed to verify who completed a redemption.
• ▪An August 2025 exploit of Cozy Finance on the Optimism blockchain resulted in a loss of approximately $427,000, according to security firm Verichains.

Cozy Finance security history

• ▪Cozy Finance ranks fifth among DeFi insurance protocols on DefiLlama, holding approximately $1.3 million in total value locked as of September 2026.
• ▪The September 7, 2026 exploit of Cozy Finance on Optimism represents the protocol's second major security breach on that blockchain.

DeFi exploit pattern

• ▪DeFi protocol Notional Finance lost $1.73 million to an integer overflow bug in the week preceding September 7, 2026.
• ▪Approximately $320 million in Bitcoin was drained from the Liquid Network on September 7, 2026, with the actors claiming white-hat intentions.
• ▪DeFi protocol Full Sail shut down operations after suffering a security exploit that drained approximately $91,000 in early September 2026.

1 source