What happened in Cozy Finance’s second exploit on the Optimism network within roughly a year—including when and how the attack unfolded, the amount and assets stolen, the manipulation of UMA’s Optimistic Oracle and resulting compensation payout, the attacker’s preparation and rap

Cozy Finance suffered its second Optimism exploit in roughly a year on September 7, 2026. The attacker turned false, undisputed UMA Oracle resolutions into payouts from Cozy’s Aave v2 and Curve protection markets, draining about $160,000–$170,000—almost all value reported on its Optimism deployment. 67

What happened

• The decisive exploit transaction occurred at 05:43 UTC on September 7. It transferred about 163,326 USDC.e through 63 token transfers and burned roughly 1.6 million Cozy PToken (CPT). 7
• The attacker first acquired PTokens in the Aave v2 and Curve protection markets, then submitted “YES” answers to UMA’s Optimistic Oracle that were not disputed. 6
• Cozy’s trigger process did not independently verify that the covered Aave/Curve failure had actually occurred, and payout eligibility was not tied to a snapshot of holders before the proposal. Once the markets were marked triggered, the attacker redeemed the PTokens for USDC. 6
• Reports therefore differ slightly on valuation—about $160,000 in one security-accounting estimate versus approximately $170,000/163,326 USDC.e in transaction-based reporting—but describe the same event. 67

Preparation and fund exit

• The attack contract was deployed on September 2, five days before the exploit, and the attacker’s wallet initially received funds from a Relay solver. 7
• At 05:56 UTC—13 minutes after the drain—the attacker approved the token and bridged the proceeds out, before the public Blockaid alert; reports said the wallet showed no subsequent movement at that point. 7
• This speed illustrates why recovery is difficult: on-chain transfers are visible, but cross-chain routing can rapidly move assets beyond the immediate reach of a protocol’s emergency response. Optimism’s bridge architecture uses the OptimismPortal as the low-level deposit/withdrawal interface and token bridges above its cross-domain messaging layer. 2

Relation to the August 2025 incident

• Cozy had already lost about $427,000 on Optimism in August 2025. 7
• That exploit stemmed from withdrawal code that did not verify the identity of the party completing a redemption. 7
• The two incidents were technically distinct—2025 was a withdrawal-authorization failure, while 2026 was an oracle/claims-trigger and payout-design failure—but together show that fixing one contract defect does not remove risk from surrounding settlement, oracle, and redemption logic. 67

Scale of the loss

• At the time, Cozy reportedly had about $1.3 million total value locked across the protocol and roughly $172,000 on Optimism. The September 2026 drain therefore appears to have swept nearly the entire Optimism deployment. 7
• Cozy operates protection markets intended to let users obtain coverage against DeFi failures, making the integrity of event resolution and claims payouts central—not peripheral—to its security model. 7

What it signals for DeFi

• Oracle risk is application risk. An optimistic oracle’s dispute-based design is unsafe for a high-value automated payout if false proposals can pass unchallenged and the integrating protocol has no independent validation, appropriate challenge incentives, or payout safeguards. The failure was in the combined system design, not evidence that an oracle alone determines real-world truth. 6
• Composability expands attack surface. The exploit connected a protection-token market, UMA-based event resolution, Cozy’s trigger logic, redemption rules, and a bridge exit path; each component may be reasonable alone, while their composition created an extractable path. 67
• Small TVL is not a security margin. The dollar amount was modest relative to major crypto hacks, but it represented nearly all Optimism-side value and followed a prior loss—material damage for affected liquidity providers and confidence in a protection protocol. 7
• The surrounding week demonstrated persistent exploit volume. Notional Finance reportedly lost about $1.73 million through an integer-overflow-related vulnerability, while separate incidents included a roughly $91,000 Full Sail loss and a disputed/claimed-white-hat extraction of about $320 million in Bitcoin from Liquid Network. 7
• Recovery remains uncertain. There is no evidence in the available material that Cozy recovered the funds. Fast bridging, potential later swaps or privacy tools, and the need for coordination among protocols, bridge operators, exchanges, analytics firms, and law enforcement all make tracing easier than actually freezing or returning assets. 27

The key lesson is that DeFi “insurance” or protection products must secure the full claims lifecycle: authentic event verification, dispute monitoring, holder snapshots, redemption authorization, circuit breakers, and a rehearsed response plan for rapid cross-chain exits.