Summary
Cozy V2 is a DeFi protection marketplace deployed on Optimism that allows users to buy or provide protection against smart contract hacks, depegs, and other on-chain risks. On August 29, 2025, the protocol suffered a $427,000 exploit caused by a missing caller verification check in its withdrawal logic, with funds subsequently bridged to Ethereum mainnet and deposited into Tornado Cash. The incident is notable for its irony: a protocol designed to insure against DeFi hacks was itself hacked through a preventable authorization flaw.
Connected Entities
1 entitiesTimeline(8 events)
2020-09-03
Cozy Finance announces $2M seed round led by Electric Capital; founders Tony Sheng and Payom Dousti publicly named.
2021-09-01
Cozy Finance V1 launches on Ethereum mainnet as an open-source protection market protocol.
2023-03-13
Euler Finance hacked for approximately $200M. Cozy V2 early-access Euler Finance market triggers and pays out to Protection Buyers, validating core trigger logic.
2023-01-01
Cozy V2 launches on Optimism (OP Mainnet) with redesigned permissionless protection marketplace architecture; V1 subsequently sunset.
2025-08-28
Victim initiates redemption of approximately $376,661 (redemption ID 6) on Cozy V2 on Optimism.
2025-08-29
Attacker exploits missing caller verification in `completeWithdraw` function, redirecting victim's redemption proceeds to attacker's address. Total loss reaches approximately $427,000.
2025-08-30
Decurity publicly reports the exploit on X, noting attacker bridged funds from Optimism to Ethereum mainnet and deposited into Tornado Cash.
2025-08-30
Verichains publishes detailed technical post-mortem of the Cozy Protocol incident, classifying the root cause as insufficient sender verification.
Decision Log
- hash: BNmAMBMsxYZxW8E1mwwE7M2fRpL8W1HTyV1xD91AYoL4
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:21 AM
last updated: 5/29/2026, 5:23:35 PM
avoid.net — verified advice for a post-truth world