Cozy V2
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 42 → 59. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +8. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6.4 |
| Incidents it suffered (e.g. hacks) | -6.4 |
| Problems around it, caused by others | -1.6 |
| Long-running | +8 |
| Sum | 59 |
Score: 59/100 (kept between 0 and 100)
How scoring works →Summary
Cozy V2 is a DeFi protection marketplace deployed on Optimism that allows users to buy or provide protection against smart contract hacks, depegs, and other on-chain risks. On August 29, 2025, the protocol suffered a $427,000 exploit caused by a missing caller verification check in its withdrawal logic, with funds subsequently bridged to Ethereum mainnet and deposited into Tornado Cash. The incident is notable for its irony: a protocol designed to insure against DeFi hacks was itself hacked through a preventable authorization flaw.
Connected Entities
6 entities · 60 linked investigations- ZachXBT→mentioned with→Ethereum(70%)
- Optimism→mentioned with→Ethereum(80%)
- Euler Finance→mentioned with→Ethereum(80%)
- Cozy V2→mentioned with→ZachXBT(65%)
- Cozy V2→mentioned with→Optimism(70%)
- Cozy V2→mentioned with→Ethereum(80%)
- Cozy Finance→mentioned with→Optimism(80%)
- Cozy Finance→mentioned with→Cozy V2(75%)
- Cozy V2→mentioned with→Cozy Finance(80%)
- Cozy V2→mentioned with→Euler Finance(80%)
1 submission awaiting moderator review.
Timeline(8 events)
3 September 2020
Cozy Finance announces $2M seed round led by Electric Capital; founders Tony Sheng and Payom Dousti publicly named.
September 2021
Cozy Finance V1 launches on Ethereum mainnet as an open-source protection market protocol.
13 March 2023
Euler Finance hacked for approximately $200M. Cozy V2 early-access Euler Finance market triggers and pays out to Protection Buyers, validating core trigger logic.
2023
Cozy V2 launches on Optimism (OP Mainnet) with redesigned permissionless protection marketplace architecture; V1 subsequently sunset.
28 August 2025
Victim initiates redemption of approximately $376,661 (redemption ID 6) on Cozy V2 on Optimism.
29 August 2025
Attacker exploits missing caller verification in `completeWithdraw` function, redirecting victim's redemption proceeds to attacker's address. Total loss reaches approximately $427,000.
30 August 2025
Decurity publicly reports the exploit on X, noting attacker bridged funds from Optimism to Ethereum mainnet and deposited into Tornado Cash.
30 August 2025
Verichains publishes detailed technical post-mortem of the Cozy Protocol incident, classifying the root cause as insufficient sender verification.
Decision Log
- slot 455366535 · hash 3VP3KZKsmVxyuXJwnk88K2zZX9e7ew9HiQqgg3pPjtK1
- slot 443508396 · hash 2U1weMNkVD1SjSp6Lk556Vu1Gfn11fvxdJwW7FEGgfCq
- slot 422983056 · hash BNmAMBMsxYZxW8E1mwwE7M2fRpL8W1HTyV1xD91AYoL4
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 5 of 10 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:21 AM
last updated: 10/10/2026, 6:46:40 PM
9 viewsavoid.net — verified advice for a post-truth world