Cozy Finance V2 UMA Optimistic Oracle Abuse — $170K

On September 2, 2026, an attacker bought cheap protection on Cozy Finance's Aave v2, Curve and Rabbithole Quests coverage markets on Optimism for approximately $3,000, then submitted a formal answer of 'YES, these were hacked' to UMA's optimistic oracle, despite no actual hack having occurred. Because Cozy's markets were largely abandoned and unmonitored, no one challenged the false claim during UMA's five-day dispute window. When the window closed on September 7, the markets resolved to YES, and the attacker legitimately claimed the full protection payout of 163,326 USDC.e, bridged the funds to Ethereum, and laundered them through Tornado Cash within minutes. This was the protocol's second loss in thirteen months. Affected coverage sets were paused for new deposits and purchases; existing suppliers can redeem their remaining share.