The Cozy Finance protocol suffered its second major hack on the Optimism network. According to BeInCrypto, on September 7, the attacker withdrew approximately $170K from the DeFi insurer and transferred the funds through a bridge in 13 minutes, before Blockaid could issue a warning. According to Optimism data, the exploit occurred at 05:43 UTC: approximately 163,326 USDC.e was moved from the protocol through 63 transactions. Simultaneously, the attacker burned about 1.6 million Cozy PToken (CPT) tokens, then withdrew the assets through the bridge at 05:56 UTC. Blockaid noted that the contract for the attack was deployed on September 2 – five days before the hack – and received initial funding from Relay solver.
This is the second hack of Cozy Finance on Optimism in less than a year. In August 2025, a similar vulnerability allowed another attacker to steal $427K. Cozy Finance manages protection markets, allowing users to purchase insurance against failures of decentralized protocols. According to DefiLlama, the protocol ranks fifth among insurance services with a total liquidity of $1.3 million. Approximately $172K was deposited on Optimism, meaning the attacker managed to withdraw nearly the entire amount from this network. The used Cozy Set (CSET) contract remains unverified; it still holds about $4,168 in USDC.e.
The recurring hacks highlight ongoing security issues in the DeFi ecosystem. Last week, Notional Finance lost $1.73 million due to an integer overflow error, while Full Sail ceased operations after approximately $91K was stolen. Blockaid indicated that initial loss estimates may change as funds are tracked – for example, the Flow hack in August was initially estimated at $9.3 million but was later reduced to $410K. The second attack on the same chain and protocol raises questions about the underlying causes of vulnerabilities.