Cozy V2 Hack

Reported loss $427K
Optimism
Insufficient Sender Verification Exploit

What happened

On August 29, 2025, Cozy Finance, a DeFi hack-protection protocol, was exploited on OP Mainnet for about $427,000. Withdrawals in Cozy took two steps: a user called redeem() to queue a redemption and got a redemption ID, then someone called completeWithdraw() with that ID to finish it. completeWithdraw() never checked who was calling, and unwrapWrappedAssetViaConnectorForWithdraw did not validate the receiver_ argument. So anyone who knew a queued redemption ID could finish another user's withdrawal and send the funds to themselves.

On August 28, a victim queued a redemption with ID 6. The next day the attacker completed it from their own account and received about 427,606 USDC.e, converted from Aave aOptUSDC.

Attacker: 0xce196f0a4f0c08e152ae66ecbc06675f44f68e66 Exploit transaction: Tx 0x71e7…a517

Within about half an hour of the exploit, the attacker address sent funds through the Orbiter Finance, Stargate and Squid bridge routers. Decurity reported that the attacker bridged the funds to a different address on Ethereum mainnet and deposited them into Tornado Cash.

How it happened

  1. On August 28, 2025, a Cozy user called redeem() to queue a withdrawal and was assigned redemption ID 6.
  2. On August 29, the attacker called completeWithdraw() from a different account and passed the victim's ID 6. The function did not check that the caller owned the redemption.
  3. The withdrawal went through unwrapWrappedAssetViaConnectorForWithdraw, which unwrapped the position's yield-bearing aOptUSDC into USDC and paid it to a receiver_ address the attacker chose.
  4. The attacker received about 427,606 USDC.e in transaction 0x71e72c...0a517. Shortly after, the attacker moved the funds out through the Orbiter, Stargate and Squid bridge routers to a different address on Ethereum mainnet and deposited them into Tornado Cash.

Protocol details

Classification Protocol Logic / Input Validation / Other
Protocol Type Insurance
Implementation language Solidity
Protocol links Website @cozyfinance

Security review history

Funds Recovery

Recovered

$1

Net Loss

$427K

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes