TL;DR:
- Cozy Finance lost roughly $170,000 in a second Optimism exploit, with the attacker bridging the funds out only 13 minutes after the initial drain.
- The exploit moved about 163,326 USDC.e through 63 transfers, while records show the attack contract had been deployed five days before the breach.
- Cozy’s Optimism deployment held roughly $172,000 beforehand, suggesting most of it was swept, while a 2025 attack had already cost the protocol $427,000.
Cozy Finance suffered a second exploit on Optimism early Monday, with an attacker draining roughly $170,000 before moving the funds through a bridge only 13 minutes later. The speed of the attack turned a relatively modest loss into a sharper security warning for the DeFi insurer, which operates protection markets allowing users to buy coverage against failures across decentralized finance. Blockaid flagged the incident after the funds had already exited, while explorer data showed no further movement from the attacker’s wallet afterward. The breach comes just over a year after Cozy endured another Optimism attack.
🚨Community alert:
Blockaid detected an ongoing exploit on @cozyfinance on Optimism.
170k$ drained so far.More details in 🧵
— Blockaid (@blockaid_) September 7, 2026
The exploit transaction landed at 05:43 UTC and moved about 163,326 USDC.e from the protocol through 63 token transfers. In the same transaction, roughly 1.6 million Cozy PToken, or CPT, were burned before the attacker approved a token and bridged the proceeds at 05:56 UTC. The preparation appears to have started days earlier rather than moments before the drain, because the attack contract was deployed on September 2, five days before the exploit. Records also show the wallet received its first funds from a Relay solver before the operation unfolded without any apparent interruption beforehand.
A Second Optimism Breach Raises Deeper Security Questions
The incident appears to center on Cozy Set, or CSET, which Blockaid identified as the abused token contract. That contract remains unverified and still held about $4,168 in USDC.e after the attack. The scale of the loss becomes more striking when measured against Cozy’s Optimism deployment, which held roughly $172,000 before the exploit, suggesting the attacker swept close to the entire amount available there. Cozy Finance ranks fifth among insurance protocols, with approximately $1.3 million in total value locked, placing the latest breach against a relatively compact capital base during the narrow attack window itself.
This is not Cozy Finance’s first security failure on Optimism. In August 2025, another attacker took about $427,000 after exploiting withdrawal code that failed to verify who completed a redemption. A second breach on the same network now raises harder questions about recurring weaknesses and defensive readiness, even though the latest loss is smaller. Blockaid said it would provide more details as tracing continues, and early exploit estimates can change as investigations progress. For Cozy, however, the immediate issue is clear: two separate attacks have now hit its Optimism operations within roughly thirteen turbulent months.
