H1: Cozy Finance Exploit: Protection-Market Logic Drains About 163K USDC.e on Optimism
Cozy Finance suffered a new exploit on Optimism on September 7 involving approximately 163,326 USDC.e.
Early security alerts rounded the value to approximately $160,000–$170,000. CEXVia uses the transaction-level figure as the more precise on-chain amount while treating the broader dollar conversion as approximate.
The attack is important because it appears to exploit assumptions in a protection-market payout and oracle-settlement design, rather than an underlying failure of Aave or Curve.
What happened?
Security researchers describe the attack sequence as follows:
- The attacker acquired protection PTokens associated with Cozy protection markets referencing Aave v2 and Curve.
- The attacker submitted “YES” assertions through an UMA Optimistic Oracle path.
- Those assertions were not successfully disputed within the relevant settlement flow.
- The protection trigger did not independently establish that a real underlying Aave/Curve hack had occurred.
- Payout eligibility was not tied to a holder snapshot taken before the malicious proposal.
- The attacker was therefore able to acquire protection and participate in the payout path around the same event trigger.
The result was an unauthorized payout from Cozy’s protection system.
The on-chain transfer
Blockaid-linked reporting described approximately 163,326 USDC.e moving through the exploit transaction at around 05:43 UTC on September 7.
The flow involved dozens of token transfers and the burning of a large amount of Cozy PToken.
Approximately 13 minutes later, the attacker had already begun bridging the proceeds.
That short interval illustrates how little time a protocol may have to intervene once a settlement flaw reaches an executable state.
Was Aave hacked?
CEXVia found no evidence that Aave v2 itself was hacked in this incident.
Aave was a referenced protection market.
The attack did not need to compromise Aave’s core lending contracts to extract value from Cozy.
Was Curve hacked?
The same distinction applies to Curve.
Curve was referenced by a protection product, but the current evidence does not establish a new Curve protocol exploit as the underlying event.
This boundary matters because headlines that say “Aave and Curve hack triggers Cozy payout” could incorrectly imply that either underlying protocol suffered the exploit.
Why the oracle path mattered
Optimistic oracle systems often assume that incorrect assertions will be disputed by participants with enough time and incentive to challenge them.
That model can be effective, but downstream protocols need to define:
- who can assert an event;
- what evidence is required;
- how long the challenge period lasts;
- what happens if nobody disputes;
- whether the downstream contract independently verifies any condition;
- who is eligible for a payout.
If the downstream contract treats an undisputed assertion as sufficient truth without additional safeguards, the security assumption becomes partly economic and operational rather than purely technical.
Why the holder snapshot mattered
Protection or insurance-like products can create adverse-selection risk if a user can:
- observe or create a trigger;
- acquire payout rights immediately before settlement;
- receive protection proceeds without having borne the covered risk beforehand.
A pre-event or pre-proposal holder snapshot is one possible way to reduce that risk.
The reported Cozy flow indicates payout eligibility was not bound to such a snapshot in the exploited path.
Attack preparation
Reporting indicates the attacker contract had been deployed several days before the exploit.
That suggests premeditation rather than a spontaneous opportunistic transaction.
The attacker also appears to have funded the operation through an external routing/solver path before execution.
Why the dollar loss understates the design significance
A roughly $163,000 loss is smaller than the major reserve and wallet incidents CEXVia is tracking this week.
The design lesson is larger.
Protection markets depend on:
- event verification;
- oracle assumptions;
- eligibility rules;
- payout timing;
- dispute incentives.
A flaw across those boundaries can make a system pay for an event that did not occur or pay a user who only acquired protection around the attack itself.
Prior Cozy incidents should remain separate
Cozy has experienced earlier security problems, including a previous Optimism incident.
The September 7, 2026 event should be treated as a separate incident with its own mechanism.
CEXVia does not combine historical losses into the current loss figure.
Evidence Status
Confirmed / Security Research + On-chain
- Cozy Finance on Optimism was exploited.
- Approximately 163,326 USDC.e was involved in the principal outflow.
- Early alerts rounded the loss to ~$160K–$170K.
- The attacker acquired protection-market PTokens.
- UMA Optimistic Oracle YES assertions were part of the path.
- Payout eligibility lacked a pre-proposal holder snapshot in the reported mechanism.
- Funds were bridged rapidly after execution.
Developing
- Cozy’s final official post-mortem.
- Exact affected protection pools.
- Whether any additional capital remains at risk.
- Final attacker proceeds after fees/bridging.
- Recovery or reimbursement.
- Protocol changes to assertion/dispute rules.
- Snapshot or eligibility redesign.
Risk Assessment
High.
The absolute loss is moderate, but the exploit demonstrates a repeatable class of protection-market settlement failure that can bypass the intended economic meaning of coverage.
What to Watch Next
- Official Cozy post-mortem.
- Emergency pause or pool shutdown.
- Additional vulnerable protection markets.
- UMA assertion/dispute analysis.
- Snapshot and payout-rule changes.
- Attacker bridge destinations.
- Exchange interaction.
- Recovery negotiations.
- User reimbursement.
- Independent audit findings.
FAQ
How much was lost?
The principal on-chain outflow was approximately 163,326 USDC.e. Early reporting rounded the event to roughly $160K–$170K.
Was Aave v2 hacked?
No evidence reviewed by CEXVia establishes an Aave v2 exploit in this incident.
Was Curve hacked?
No evidence reviewed establishes a new Curve exploit here.
What did the attacker exploit?
The reported mechanism involved Cozy protection-market eligibility and an undisputed UMA Optimistic Oracle YES path.
Why did a snapshot matter?
Without a pre-proposal holder snapshot, an attacker may be able to acquire protection rights close to the event trigger and still qualify for payout.
Has Cozy published a final post-mortem?
A final complete post-mortem was not identified in the material reviewed for this report.