What happened
Ajna is a peer-to-peer, oracleless, permissionless lending protocol with no governance, accepting both fungible and non-fungible tokens as collateral.
Between August 28 and 29, 2026, an attacker drained about $775,400 from seven Ajna v2 pools on Ethereum. The largest losses were the syrupUSDC pool (about $173.7K), wstETH (about $159.8K), rETH (about $143.0K over two transactions) and cbETH (about $136.9K over two transactions), followed by WBTC (about $101.8K), WETH/USDC (about $42.0K) and sDAI (about $18.0K).
No oracle was involved. The attacker abused Ajna's liquidation accounting. Because the contracts are immutable and have no pause switch, on August 29 the Ajna team told users to withdraw their quote tokens, repay loans and stop using the protocol. Monitoring firm Defimon said it flagged the prepared attack more than an hour before the first exploit transaction, and that the alert it sent to the Ajna team on Discord was not acted on. No recovery had been reported when the incident was covered.
How it happened
The steps below follow the DeFiHackLabs reconstruction of the cbETH pool transaction. Ajna has not published a postmortem, so treat the exact root cause as provisional.
- The attacker deployed attack contracts on August 28 at about 15:16 UTC. They controlled both an over-leveraged borrower position and the taker contract that would liquidate it.
- The taker called
bucketTake()on that borrower. Because no external oracle checks Ajna's internal prices, the attacker could shape the price the liquidation settled at, and was credited LP in the bucket. - The taker used the new LP to pull collateral with
removeCollateral(), and the attacker's borrower then repaid withrepayDebt()to free the rest of its collateral. - In the first cbETH transaction, about 3.47 WETH went in and about 48.13 cbETH (about $124.8K) came out. The same pattern then hit six more pools.
Protocol details
Security review history
- Code4rena View report
- Quantstamp View report
- Sherlock View report
- Trail of Bits View report
Evidence
- code Add AjnaFinance exploit PoC - liquidation accounting manipulation (DeFiHackLabs PR #1248, merged 2026-09-11) github.com
- analysis DeFiLlama defillama.com
- analysis Ajna v2 Loses $775K on Ethereum After Attacker Exploits Liquidation Math (The Crypto Times, 2026-08-29) cryptotimes.io
- analysis Ajna Exploit: $775,400 From Seven ETH Pools (CryptoTicker, 2026-08-30) cryptoticker.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
