A Cozy Finance exploit drained approximately $170,000 from the DeFi insurer on Optimism, marking the second major attack on the protocol. According to reports from Blockaid, the attacker executed the exploit within 13 minutes of the transaction landing at 05:43 UTC on Monday. The exploit moved about 163,326 USDC.e out of the protocol across 63 token transfers, while simultaneously burning roughly 1.6 million Cozy PToken (CPT). As per Blockaid, the attacker's wallet sourced initial funds from a Relay solver before executing the main attack, with the transaction including an approval step before the assets exited via a bridge at 05:56 UTC.
The attacker prepared extensively for the exploit, with records showing the attack contract went live on September 2, five days before the drain. As reported by Blockaid, the wallet drew its first funds from a Relay solver before executing the main attack. The same transaction burned roughly 1.6 million Cozy PToken (CPT) before the attacker approved a token and pushed the funds through a bridge at 05:56 UTC. Explorer records show no further movement from the wallet since the exit. The incident follows several recent DeFi losses, including a $1.73 million integer overflow at one protocol and an attacker extraction of about $91,000 at another project.
This marks the second major security incident for Cozy Finance on Optimism, following an attack in August 2025 that cost the protocol approximately $427,000. According to reports from Verichains, the previous flaw resided in the withdrawal code that never checked who completed a redemption. Cozy Finance now ranks fifth among insurance protocols on DefiLlama, holding approximately $1.3 million in total value. The attacker removed nearly the protocol's entire deployment on Optimism, with about $172,000 of the total value locked on that chain.
The Cozy Finance exploit represents part of a concerning trend in DeFi security, with similar incidents occurring across the sector. As reported by Blockaid, Notional Finance lost $1.73 million last week to an integer overflow bug, while Full Sail wound down operations after an attacker took roughly $91,000. The firm noted that Monday brought a far larger case with approximately $320 million in Bitcoin leaving the Liquid Network, though actors claimed white hat intentions on-chain. Cozy users and protocol maintainers are reviewing exposure across chains and assessing whether remaining contracts require verification or emergency fixes.
