Security company Blockaid has detected that the decentralized finance risk management protocol Cozy Finance's contracts deployed on Optimism are under continuous attack, with attackers having transferred approximately $170,000 in assets as of the disclosure.

On-chain traces indicate that both stablecoins and protocol tokens were moved simultaneously. English assembly records show multiple addresses transferring USD Coin bridged from Optimism and destroying Cozy PToken; a successfully marked transaction occurred in block 156580507. Blockaid has released preliminary attack information, marking attack transactions, multiple attacker addresses, and a suspected token address that was exploited. It has not yet been confirmed by officials whether the attack is still ongoing, and interactions with related contracts are advised to be approached with caution.

This is not the first time the protocol has suffered losses on the same chain. On August 30, 2025, Cozy Finance, positioned as a "hacker protection" protocol, was hacked for approximately $427,000. At that time, the redemption process was in two steps: first calling redeem() on the CSET contract to obtain a redemption number, and then calling completeWithdraw(). The completeWithdraw() function did not verify the caller's identity, allowing anyone to complete the withdrawal by submitting another person's redemption number; unwrapWrappedAssetViaConnectorForWithdraw also allowed the recipient address to be set to any account. A user initiated a redemption of about $427,000 on August 28 and received number 6, with the funds being taken by someone else, subsequently bridged to the Ethereum mainnet and entered a mixer. The same user had just completed a redemption of about $677,000 prior to this.

The amount is relatively small in the context of the 2026 loss ledger. Blockaid reported 212 verified attacks in the first half of the year, resulting in losses of approximately $1.1 billion, which is 3.4 times the total for the entire year of 2025; operational security and private key theft accounted for about 74% of the losses, with KelpDAO and Drift alone accounting for approximately $292 million and $285 million, respectively. Ostium lost about $18 million USDC on Arbitrum due to an oracle hack, also reported to authorities by Blockaid. Small, multi-address, and repeatable attacks are statistically easy to be overshadowed by larger sums but continue to probe open function interfaces.

Cozy positions itself as a Safety Stack: the first layer is loss protection, the second layer is bad debt protection, and the third layer is disaster protection, situated between loan protocols and extreme losses. After events like Stream Finance, it has articulated the need for "mainstream institutions to send user funds into on-chain vaults." The protection protocol's own withdrawal and token destruction paths have been repeatedly breached, leaving those who buy protection facing risks from the protection layer contracts rather than the underlying loan protocol risks.

In market mechanics, what is sold are bridged USDC and destructible PToken from the protocol vault, while what is bought are addresses controlled by attackers. The event-driven nature is clear: interfaces can be called repeatedly without waiting for governance or oracle windows. Funds flow from the Optimism vault to the attack addresses, with historical precedents showing they are bridged again and enter mixers. Beneficiaries are security firms that can monitor and mark addresses first, and front-running liquidation bots; those under pressure are depositors who still leave funds in Cozy-related contracts and those who treat the "insurance layer" as a fully audited final state. $170,000 may not change the total industry loss, but it will change who dares to treat the protection module as an unconditional safety net.

Source: Public Information