Cozy Finance (V2 protection markets) hack — September 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Other |
| Loss | $163,326Price at time of incident |
| Method | Other or undisclosedA single transaction drained an unverified Cozy Set contract of 163,326 USDC.e; the root cause has not been published |
| Chains | Optimism |
| Outcome | Unresolved |
What happened
Cozy Finance's V2 protection markets on Optimism were drained of 163,326 USDC.e at 05:43 UTC on 7 September 2026, nearly everything the protocol had deployed on that chain. The Optimism deployment held about $172,000 beforehand, and the exploited contract, an unverified Cozy Set token contract, was left with about $4,168.
Blockaid flagged the exploit while it was under way and put it at $170,000, the figure most outlets repeated. The token count moved is the more precise measure, and USDC.e is a dollar stablecoin. The single transaction made 63 token transfers and burned roughly 1.6 million Cozy PTokens along the way. The attack contract had been deployed on 2 September, five days earlier, with initial funds from a Relay solver, and the proceeds were bridged out thirteen minutes after the drain, at 05:56 UTC. No further activity from the attacker's wallet had been seen at the time of reporting.
The root cause has not been published and Cozy has made no public statement, so the vector is recorded as undisclosed. This is the protocol's second loss on Optimism: in August 2025 an attacker took about $427,000 through withdrawal code that never checked who completed a redemption. Cozy ranked fifth among DeFi insurance protocols, with about $1.3m in total value locked.
Sources
- GNcryptoSecondary · retrieved 2026-09-10
- Crypto EconomySecondary · retrieved 2026-09-10
Changes to this entry
- Recorded three days after the incident. The amount is the 163,326 USDC.e moved, not Blockaid's rounded in-progress figure of $170,000. Cozy Finance has published no statement or root cause; the vector will be updated if it does.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Cozy Finance (V2 protection markets) hack — September 2026", iTokenly, accessed 2026-09-11, https://itokenly.com/hacks/cozy-finance-september-2026https://itokenly.com/hacks/cozy-finance-september-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.