Cozy Finance (completeWithdraw redemption) hack — August 2025
Incident facts
| Date of incident | |
|---|---|
| Target type | Other |
| Loss | $427,606Price at time of incident |
| Method | Access control flawCozy's completeWithdraw neither checked who was calling it nor validated its receiver argument, so anyone could complete another user's queued redemption and route the proceeds to an address of their own |
| Chains | Optimism |
| Outcome | Unresolved |
What happened
Cozy Finance, which runs protection markets that let users buy cover against failures in other DeFi protocols, lost 427,606 USDC.e on Optimism at 04:43:33 UTC on 29 August 2025, in a single transaction. This registry read that transaction's receipt on Optimism: the attacker's address received 427,606.14 USDC.e in it, and that is the figure recorded here. Publishers round it to about $427,000.
Verichains, which published a technical write-up on 15 October 2025, traces the loss to Cozy's completeWithdraw function, which did not verify the caller and did not validate its receiver argument. The attacker called completeWithdraw with a victim's redemption identifier, then called the routine that unwraps the yield-bearing asset for a withdrawal, converting aOptUSDC into USDC and sending it to an address of their own. The victim redemption named in that write-up was worth about $376,661.
Cozy never published a post-mortem. The same deployment was exploited again on 7 September 2026, for 163,326 USDC.e, and that incident has its own entry in this registry; by then the whole Optimism deployment held only about $172,000, so this first loss was much the larger of the two.
Sources
- Verichains, technical analysisSecondary · retrieved 2026-09-19
- GNcryptoSecondary · retrieved 2026-09-19
- Optimism transaction receipt, read by this registryOn-chain · retrieved 2026-09-19
Changes to this entry
- Backfilled a year on, a gap flagged during the 10 September 2026 sweep. The amount is the 427,606.14 USDC.e this registry read from the attack transaction's receipt on Optimism, rather than the rounded $427,000 publishers carry. The mechanism follows Verichains' write-up of 15 October 2025; Cozy has never published a post-mortem of its own.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Cozy Finance (completeWithdraw redemption) hack — August 2025", iTokenly, accessed 2026-09-19, https://itokenly.com/hacks/cozy-finance-august-2025https://itokenly.com/hacks/cozy-finance-august-2025Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.