{"investigation":{"slug":"cozy-finance","entity_name":"Cozy Finance","trust_score":14,"severity_base":null,"score_modifier":0,"confidence":0.55,"status":"published","content_type":"investigation","summary":"Cozy Finance, a DeFi coverage/insurance protocol built on the Cozy V2 stack and deployed on Optimism, has suffered two confirmed exploits within roughly thirteen months: an alleged $427,000 loss in August 2025 tied to a missing caller-identity check in its withdrawal code, and an alleged $170,000 loss on September 7, 2026 whose root cause is disputed across secondary reporting. The recurrence of a fund-draining incident on the same chain, with no public post-mortem or protocol response identified for the second event as of this writing, indicates unresolved security and governance risk independent of which technical account of the second exploit is correct.","sections":[{"content":"Security research firm Verichains reported that on August 29, 2025, Cozy Finance was exploited on the OP Mainnet (Optimism) network for approximately $427,000. According to Verichains' technical writeup, the vulnerability sat in the protocol's `completeWithdraw` function, which allegedly did not verify the caller's identity or validate the `receiver_` argument. The attacker allegedly obtained a legitimate user's redemption ID from an earlier transaction — a victim had initiated a redemption for roughly $376,661 — and called `completeWithdraw` with that same ID from a different account, then routed the underlying yield-bearing tokens through `unwrapWrappedAssetViaConnectorForWithdraw` to convert them to USDC and divert them to the attacker's address. This has since been described by multiple outlets as a protocol-logic / access-control failure rather than an oracle or price-manipulation issue.","heading":"First Confirmed Exploit — August 2025 ($427,000)","sources":[{"url":"https://blog.verichains.io/p/cozy-protocol-incident","name":"Cozy Protocol Incident — Verichains blog","type":"research","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/cozy-finance-exploit-drains-170-091109362.html","name":"Cozy Finance Exploit Drains $170,000 From DeFi Insurer for a 2nd Time — Yahoo Finance/BeInCrypto","type":"news_article","credibility":2}],"severity":"high"},{"content":"Security firm Blockaid flagged a second exploit against Cozy Finance's Optimism deployment. Multiple outlets reported that the exploit transaction landed at 05:43 UTC on a Monday, moving approximately 163,326 USDC.e out of the protocol across 63 token transfers in a single transaction, and that the attacker burned roughly 1.6 million Cozy PToken (CPT) in the process. The attacker allegedly bridged the proceeds out at 05:56 UTC — 13 minutes after the initial drain — reportedly before Blockaid's alert was published, and blockchain explorers reportedly show no further activity from the attacker's wallet afterward. Reporting indicates the attack contract had been deployed on September 2, 2026, five days ahead of the drain, suggesting premeditation rather than an opportunistic strike. Cozy's Optimism deployment reportedly held only about $172,000 before the attack, meaning the attacker took close to the entire chain-specific balance. As of the most recent reporting reviewed, neither Cozy Finance nor Optimism had issued a public statement or post-mortem on this second incident.","heading":"Second Confirmed Exploit — September 7, 2026 ($170,000)","sources":[{"url":"https://beincrypto.com/cozy-finance-exploit-optimism-second-hack/","name":"Cozy Finance Exploit Drains $170,000 From DeFi Insurer for a 2nd Time — BeInCrypto","type":"news_article","credibility":2},{"url":"https://bitcoinethereumnews.com/tech/cozy-finance-exploit-highlights-defi-security-flaws/","name":"Cozy Finance Exploit Highlights DeFi Security Flaws — bitcoinethereumnews.com","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/cozy-finance-suffers-second-exploit/","name":"Cozy Finance Suffers Second Exploit, Losing $170K in a Rapid Attack — Crypto Economy","type":"news_article","credibility":2},{"url":"https://www.gncrypto.news/news/cozy-finance-exploited-on-optimism-170k-drained/","name":"Cozy Finance Exploited on Optimism - $170K Drained — GNCrypto News","type":"news_article","credibility":2},{"url":"https://shattered.io/defi-price-manipulation-exploits-triple-32-2026/","name":"DeFi Price Manipulation Exploits Triple to 32 [2026] — shattered.io","type":"research","credibility":2}],"severity":"critical"},{"content":"Secondary reporting on the September 7, 2026 exploit is internally inconsistent about its root cause, and this dossier flags that conflict rather than asserting either account as established fact. One set of outlets — including BeInCrypto (syndicated via Yahoo Finance), bitcoinethereumnews.com, Crypto Economy, GNCrypto News, and the research outlet shattered.io — describe the exploit purely in terms of the Cozy Set (CSET) token contract and Cozy PToken (CPT) accounting, with no mention of UMA or an oracle at all; shattered.io explicitly characterizes it as a \"protocol-logic exploit\" involving how the contract calculated exposure, not a corrupted price feed. A separate set of outlets — Coinfomania, Cryptonomist, and a site publishing under the name \"CoinDesk\" at the domain coindesk.cc (which is not the domain of the establishment outlet CoinDesk.com and should be treated with reduced credibility as a possible lookalike/aggregator) — describe the same dollar loss as the result of an attacker submitting a false price proposal to the UMA Optimistic Oracle that went unchallenged and triggered fraudulent compensation payouts. No source reviewed provided an on-chain transaction trace, an official Cozy Finance statement, or a Blockaid technical report that unambiguously reconciled these two accounts, and no public post-mortem had been identified as of this writing. Given that the more transaction-detail-rich reporting (exact UTC timestamps, token-transfer counts, contract deployment date) consistently omits any UMA reference, the UMA Optimistic Oracle causation claim should be treated as unverified and low-to-medium confidence pending a primary technical disclosure.","heading":"Disputed Attack Mechanism: Protocol-Logic Bug vs. UMA Optimistic Oracle Manipulation","sources":[{"url":"https://coinfomania.com/cozy-finance-reports-160k-exploit-via-uma-optimistic-oracle/","name":"Cozy Finance Reports $160K Exploit via UMA Optimistic Oracle — Coinfomania","type":"news_article","credibility":3},{"url":"https://en.cryptonomist.ch/2026/09/07/cozy-finance-exploit-defi-security/","name":"Cozy Finance Exploit Highlights DeFi Security Flaws — Cryptonomist","type":"news_article","credibility":3},{"url":"https://coindesk.cc/cozy-finance-exploit-drains-160k-after-attacker-games-uma-oracle-110826.html","name":"Cozy Finance exploit drains $160K after attacker games UMA oracle — coindesk.cc (lookalike domain, not CoinDesk.com)","type":"news_article","credibility":3},{"url":"https://shattered.io/defi-price-manipulation-exploits-triple-32-2026/","name":"DeFi Price Manipulation Exploits Triple to 32 [2026] — shattered.io","type":"research","credibility":2}],"severity":"medium"},{"content":"Regardless of which technical account of the September 2026 exploit is accurate, both confirmed incidents share structural risk factors: both targeted Cozy Finance's coverage/redemption accounting on the Optimism deployment, both allegedly involved an attacker exploiting how the protocol tracked ownership of claims or exposure (a reused redemption ID in 2025; CSET/CPT accounting or, per disputed reporting, an oracle price dispute window in 2026), and both were drained rapidly once triggered. shattered.io explicitly raised the concern that \"a protocol that has already been exploited once should... have hardened its attack surface,\" questioning why a second incident occurred within roughly thirteen months of the first. No source reviewed identified a public audit, bug-bounty payout, or remediation disclosure issued by Cozy Finance between the August 2025 and September 2026 incidents. This absence of a documented fix is itself a materially negative signal independent of the exact 2026 attack vector, since a protocol handling insurance-style payouts failed to prevent a second fund-draining event of comparable rapid execution.","heading":"Absence of Remediation Between Incidents","sources":[{"url":"https://shattered.io/defi-price-manipulation-exploits-triple-32-2026/","name":"DeFi Price Manipulation Exploits Triple to 32 [2026] — shattered.io","type":"research","credibility":2},{"url":"https://blog.verichains.io/p/cozy-protocol-incident","name":"Cozy Protocol Incident — Verichains blog","type":"research","credibility":2}],"severity":"high"},{"content":"Across the two confirmed incidents, reported losses total approximately $597,000 (roughly $427,000 in August 2025 plus roughly $170,000 in September 2026). At the time of the second exploit, Cozy Finance reportedly ranked fifth among insurance-category protocols tracked by DefiLlama, with total value locked of approximately $1.3 million across chains, of which roughly $172,000 was deployed on Optimism — meaning the September 2026 attacker allegedly swept close to the entire Optimism-specific balance in a single 13-minute window. The small absolute TVL limits systemic impact but underscores that the protocol's security failures have been proportionally severe relative to its size on the affected chain.","heading":"Financial Impact and Protocol Scale","sources":[{"url":"https://defillama.com/protocol/cozy-finance","name":"Cozy Finance — DefiLlama","type":"on_chain","credibility":2},{"url":"https://crypto-economy.com/cozy-finance-suffers-second-exploit/","name":"Cozy Finance Suffers Second Exploit, Losing $170K in a Rapid Attack — Crypto Economy","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2025-08-29","event":"First confirmed exploit: approximately $427,000 allegedly drained via a missing caller-identity check in the completeWithdraw redemption function.","source":"Verichains blog","source_url":"https://blog.verichains.io/p/cozy-protocol-incident","date_evidence":"On August 29, 2025, Cozy Finance was exploited through a vulnerability on the OP Mainnet Network, resulting in the loss of approximately $427,000."},{"date":"2026-09","event":"Attack contract for the second exploit allegedly deployed on Optimism, five days ahead of the drain.","source":"bitcoinethereumnews.com","source_url":"https://bitcoinethereumnews.com/tech/cozy-finance-exploit-drains-170000-from-defi-insurer-for-a-2nd-time/","date_evidence":"Records show the attack contract went live on September 2, five days before the drain.","date_original":"2026-09-02"},{"date":"2026-09-07","event":"Second confirmed exploit: approximately $170,000 (163,326 USDC.e) allegedly drained from Cozy Finance's Optimism deployment and bridged out within 13 minutes; root cause disputed between a CSET/CPT protocol-logic account and a UMA Optimistic Oracle manipulation account.","source":"GNCrypto News / bitcoinethereumnews.com","source_url":"https://www.gncrypto.news/news/cozy-finance-exploited-on-optimism-170k-drained/","date_evidence":"7 September 2026 [article publication/incident date header]; the exploit transaction landed at 05:43 UTC on Monday, according to OP Mainnet explorer data."}],"sources_used":[{"url":"https://blog.verichains.io/p/cozy-protocol-incident","name":"Cozy Protocol Incident — Verichains blog","type":"research","archive_url":"http://web.archive.org/web/20260515173259/https://blog.verichains.io/p/cozy-protocol-incident","credibility":2,"archive_timestamp":"2026-05-15T17:32:59+00:00"},{"url":"https://finance.yahoo.com/markets/crypto/articles/cozy-finance-exploit-drains-170-091109362.html","name":"Cozy Finance Exploit Drains $170,000 From DeFi Insurer for a 2nd Time — Yahoo Finance/BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://beincrypto.com/cozy-finance-exploit-optimism-second-hack/","name":"Cozy Finance Exploit Drains $170,000 From DeFi Insurer for a 2nd Time — BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://bitcoinethereumnews.com/tech/cozy-finance-exploit-highlights-defi-security-flaws/","name":"Cozy Finance Exploit Highlights DeFi Security Flaws — bitcoinethereumnews.com","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://bitcoinethereumnews.com/tech/cozy-finance-exploit-drains-170000-from-defi-insurer-for-a-2nd-time/","name":"Cozy Finance Exploit Drains $170,000 From DeFi Insurer for a 2nd Time — bitcoinethereumnews.com","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://crypto-economy.com/cozy-finance-suffers-second-exploit/","name":"Cozy Finance Suffers Second Exploit, Losing $170K in a Rapid Attack — Crypto Economy","type":"news_article","archive_url":"https://web.archive.org/web/20260912021120/https://crypto-economy.com/cozy-finance-suffers-second-exploit/","credibility":2,"archive_timestamp":"2026-09-12T02:11:20+00:00"},{"url":"https://www.gncrypto.news/news/cozy-finance-exploited-on-optimism-170k-drained/","name":"Cozy Finance Exploited on Optimism - $170K Drained — GNCrypto News","type":"news_article","archive_url":"https://web.archive.org/web/20260912022011/https://www.gncrypto.news/news/cozy-finance-exploited-on-optimism-170k-drained/","credibility":2,"archive_timestamp":"2026-09-12T02:20:11+00:00"},{"url":"https://shattered.io/defi-price-manipulation-exploits-triple-32-2026/","name":"DeFi Price Manipulation Exploits Triple to 32 [2026] — shattered.io","type":"research","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://coinfomania.com/cozy-finance-reports-160k-exploit-via-uma-optimistic-oracle/","name":"Cozy Finance Reports $160K Exploit via UMA Optimistic Oracle — Coinfomania","type":"news_article","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://en.cryptonomist.ch/2026/09/07/cozy-finance-exploit-defi-security/","name":"Cozy Finance Exploit Highlights DeFi Security Flaws — Cryptonomist","type":"news_article","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://coindesk.cc/cozy-finance-exploit-drains-160k-after-attacker-games-uma-oracle-110826.html","name":"Cozy Finance exploit drains $160K after attacker games UMA oracle — coindesk.cc","type":"news_article","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://defillama.com/protocol/cozy-finance","name":"Cozy Finance — DefiLlama","type":"on_chain","archive_url":"http://web.archive.org/web/20250914174826/https://defillama.com/protocol/cozy-finance","credibility":2,"archive_timestamp":"2025-09-14T17:48:26+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-11T23:19:11.663482+00:00","updated_at":"2026-09-12T02:23:01.025453+00:00"}}