Cozy Finance (V2 protection markets) hack — September 2026

Cozy Finance's V2 protection markets on Optimism were drained of 163,326 USDC.e at 05:43 UTC on 7 September 2026, nearly everything the protocol had deployed on that chain. The Optimism deployment held about $172,000 beforehand, and the exploited contract, an unverified Cozy Set token contract, was left with about $4,168.

Blockaid flagged the exploit while it was under way and put it at $170,000, the figure most outlets repeated. The token count moved is the more precise measure, and USDC.e is a dollar stablecoin. The single transaction made 63 token transfers and burned roughly 1.6 million Cozy PTokens along the way. The attack contract had been deployed on 2 September, five days earlier, with initial funds from a Relay solver, and the proceeds were bridged out thirteen minutes after the drain, at 05:56 UTC. No further activity from the attacker's wallet had been seen at the time of reporting.

SlowMist traced the drain to the oracle rather than to a bug in Cozy's contract code: the attacker submitted a false price proposal to UMA's Optimistic Oracle, which accepts a submitted answer unless someone disputes it within a set window. Nobody disputed it, and the proposal triggered compensation payouts before the problem surfaced. Cozy has published no statement or post-mortem of its own, so the vector rests on SlowMist's reading and will be revised if Cozy says otherwise. This is the protocol's second loss on Optimism: in August 2025 an attacker took about $427,000 through withdrawal code that never checked who completed a redemption. Cozy ranked fifth among DeFi insurance protocols, with about $1.3m in total value locked.