Cozy V2 Hack

On August 30, 2025, Cozy Finance, a DeFi hack protection protocol on Optimism, was exploited for $427,000. The attacker exploited a vulnerability in the withdrawal process that allowed anyone to complete another user's redemption, stealing funds that were then bridged to Ethereum mainnet and deposited into Tornado Cash for laundering.

The vulnerability existed in Cozy Finance's two-step redemption process for their CSET contract. Users must first call redeem() to initiate a withdrawal and receive a redemption ID, then call completeWithdraw() with that ID to finalize the withdrawal. However, the completeWithdraw() function failed to verify the caller's identity, allowing anyone to complete withdrawals on behalf of other users by simply providing their redemption ID.

On August 28, victim user 0xd4398 initiated a redemption for $427,000 and received ID 6. The attacker exploited this by calling completeWithdraw() with the victim's redemption ID, completing the withdrawal to their own address and stealing $427,000 USDC from Aave. The exploit was facilitated by the unwrapWrappedAssetViaConnectorForWithdraw function which allows the receiver argument to be any address.

The attacker could have stolen even more, as the same victim had completed another withdrawal of $677,000 just before the attack. After stealing the funds, the attacker bridged them to Ethereum mainnet and deposited them into Tornado Cash for obfuscation.

Exploit tx:

https://optimistic.etherscan.io/tx/0x71e72cae…c0a517