Cozy Finance Hit by Second Optimism Exploit; $170K Drained and Bridged Out in 13 Minutes

Cozy Finance was exploited on Optimism early Monday for a second time, with roughly $170,000 drained and then bridged out just 13 minutes after the initial outflow. On-chain data shows the first exploit transaction executed at 05:43 UTC, moving about 163,326 USDC.e out of the protocol via 63 token transfers. In the same transaction, around 1.6 million Cozy PToken (CPT) were burned. The attacker later approved a token and bridged the proceeds at 05:56 UTC. Security firm Blockaid said it detected an active exploit affecting @cozyfinance on Optimism, but the alert came after the funds had already exited. Explorer data indicated no further activity from the attacker's wallet following the bridge. The setup appears to have begun days in advance. The attack contract was deployed on September 2, five days before the breach, and the wallet reportedly received its initial funding from a Relay solver prior to the operation. Blockaid attributed the incident to Cozy Set (CSET), which it identified as the abused token contract. The contract remains unverified and still held about $4,168 in USDC.e after the attack. The loss is notable relative to the capital on Cozy's Optimism deployment. That deployment held roughly $172,000 before the exploit, indicating the attacker likely swept nearly the entire available balance. Cozy Finance ranks fifth among insurance protocols by total value locked, with about $1.3 million in TVL, underscoring how a six-figure incident can materially impact a relatively compact capital base. The latest breach follows an earlier Optimism exploit in August 2025, when an attacker stole about $427,000 by abusing withdrawal logic that did not verify who completed a redemption. With two separate incidents now affecting the protocol's Optimism operations within roughly 13 months, the repeat breach is expected to intensify scrutiny of Cozy's security posture. Blockaid said additional details may follow as tracing continues, noting early loss estimates can change as investigations develop.