Ajna v2, the immutable, oracleless, no-governance lending protocol, lost roughly $775,000 across seven Ethereum pools between August 28 and August 29, 2026, in what appears to be a liquidation accounting exploit rather than an oracle attack. The team acknowledged the incident publicly at 04:58 UTC on August 29 and asked users to withdraw all quote tokens, repay loans, and stop interacting with the protocol.
Security firm Defimon posted a full pool-by-pool loss table roughly four and a half hours later, claiming its detection stack had identified the prepared attack more than an hour before the first exploit transaction landed and that its Discord notification to the Ajna team went unactioned.
Losses are small in absolute terms compared with recent DeFi incidents this month, but the incident carries outsized weight because it reopens a design question that Ajna was built to answer: whether an oracleless, immutable lending market can be attacked purely through its own internal price discovery, without any external feed to spoof and without any governance switch to flip in defence.
How Ajna Works and Why That Matters Here
Ajna is a peer-to-pool lending protocol that avoids external price feeds entirely. Lenders deposit quote tokens into discrete price buckets, borrowers post collateral, and liquidations run through an internal set of primitives called kick, take, bucketTake, and settle, referenced against Lowest Utilized Price (LUP) and threshold price rather than a Chainlink or Pyth feed. That design has always been the protocol’s pitch and its risk. There is nothing to spoof from outside, but the internal accounting has to be watertight against manipulation from within a single transaction.
The Ajna v2 whitepaper formalises the LUP, threshold price, and neutral price relationships that determine when a position becomes liquidatable and how takers are compensated.
Public evidence suggests attack contracts were deployed at approximately 15:16 UTC on August 28. The first extraction transaction on the cbETH pool landed at 16:19 UTC on the same day, in block 25854888, with the transaction hash 0x12df…4e4f5. The same selector was reused the following morning against a different attack contract, per public reconstructions circulating in security researcher circles, with preparation funding routed through Tornado Cash.
The Ajna team’s first public acknowledgement came at 04:58 UTC on August 29, describing the situation as an ongoing investigation into “unusual movements” and asking users to exit. Defimon’s detailed accounting followed at 09:29 UTC that same morning, listing the pool-by-pool damage and flagging the missed early-warning window.
The Pool-by-Pool Damage: $775K Across Seven Markets
The seven affected Ajna v2 pools, per Defimon’s public accounting, split the losses unevenly across paired-collateral markets. The syrupUSDC pool absorbed the largest single loss at $173.7K, followed by wstETH at $159.8K.
The rETH pool lost $127.4K in one leg and a further $15.6K in a second extraction, while cbETH lost $124.8K and $12.1K across two separate transactions. WBTC saw $101.8K walk out, WETH/USDC lost $42.0K, and sDAI closed the list at $18.0K, bringing the running total to roughly $775.4K.
The split figures on rETH and cbETH reflect two extraction transactions on those pools rather than one, and every single pool that was touched was a paired collateral market. No stablecoin-only or exotic-collateral pool appeared on the loss table.
Inside the cbETH Harvest Transaction
The sample transaction is the most publicly reconstructed leg of the attack and offers the clearest read on the mechanics. Naive explorer decoders label it as two Uniswap v3 swaps. The balance-change view tells a different story.
On that single transaction, the Ajna ERC20Pool contract lost roughly 48.13 cbETH and gained 3.47 WETH, a net collateral bleed of about $133K out against roughly $8.5K quote in. The attack contract at 0x80AD… picked up 43.75 cbETH, valued at approximately $121K, while a separate externally owned account at 0x6F2f… captured 1.72 WETH. The borrower position referenced in the emitted logs is 0x02D329…, and the bucket index used was 2000.
The published on-chain sequence for that harvest, as reconstructed publicly, ran as follows:
- Flashloan 4 WETH from Balancer.
- Call bucketTake on a sitting auction. The taker was credited with all LP for that step; the kicker received zero. A follow-on removeCollateral burned that LP and pulled 1.51 cbETH out of the pool.
- Dump the extracted cbETH into Uniswap v3. That leg generated 1.72 WETH, which routed to the EOA at 0x6F2f…
- Call take() on the rest of the auction. The attacker paid 3.47 WETH into the pool and received 0.106 cbETH.
- Call AuctionSettle and repayDebt with quoteRepaid = 0. This is the step that gets weird. The remaining 46.51 cbETH of collateral left the pool on that call.
- Repay the Balancer flash loan. Keep the cbETH.
The net effect is that the pool paid out most of an auctioned borrower’s collateral to the taker while receiving almost nothing in quote tokens back, with the settle step doing the final sweep. A naive swap-decoder view of the tx misses this entirely, because the material action is not a swap; it is the sequence of LP-minting, collateral removal, and zero-quote settlement across Ajna’s own liquidation primitives.
Two Competing Theories on Root Cause
Independent researchers have advanced two different reconstructions, and neither has been reconciled by an official Ajna postmortem as of publication.
The first theory, associated with public write-ups from ShiroCipher, is a harvest theory: the attacker did not create the underpriced auction; they found one already sitting on the book and drained it via the bucketTake, removeCollateral, take, settle sequence above. If LUP is at MIN_PRICE and an auction has been idle, the math can close in a way that lets the taker sweep collateral against effectively no quote settlement.
The second theory, associated with Red Willy, is a setup theory rather than a harvest theory: the attacker used same-transaction pool accounting to control the auction price at kick. The published outline is drawDebt, repayDebt, addQuoteToken, and kick executed atomically inside one transaction, opening a liquidation on a position whose collateral had been made to look undervalued relative to the pool’s internal state at that instant.
Both patterns can be true on different pools or on different phases of the same overall attack. What both share is that they exploit Ajna’s internal accounting between liquidation primitives, not any external price source.
Why Ajna’s Design Matters Here
Ajna’s core value proposition was oracleless price discovery. The drain did not require a fake Chainlink or Pyth price. Public analysis instead points to three interacting properties of the liquidation code path: bucketTake can mint LP to the taker; removeCollateral can pull against that freshly minted LP; and settle can move leftover collateral out of the pool when quoteRepaid is zero. Under specific conditions on LUP position and auction age, that chain closes without looking broken to a decoder that only understands swap and transfer events.
Older audit literature already flagged categories of risk in this general neighbourhood. Ajna’s audit repository contains prior findings on spurious kicks, LUP manipulation through quote-token removal or short-lived borrows, and settlement of artificial bad debt against reserves. Those are prior risk categories rather than proof that this specific 2026 exploit chain is the same as any single previously acknowledged bug.
Ajna also has a documented earlier history of vulnerability disclosure: in 2023, Ajna Finance publicly asked users to withdraw funds after identifying an unspecified potential exploit path pre-v2, an incident recalled now for its striking similarity in tone to the August 29 statement.
The design has one more consequence worth naming plainly. Because Ajna v2 is immutable and has no governance, a live code patch is not the standard response path. The team’s request that users exit is not a rhetorical choice; it is the response tool the design leaves them. That is a very different security posture from a governed lending market, where an emergency multisig could pause a pool, freeze a market, or roll a fix. On Ajna v2, users are the pause button.
Broader Context: A Second Consecutive Week of Design-Level DeFi Failures
The Ajna incident lands in an unusually rough two weeks for DeFi security. On August 27, Moonwell on Base lost roughly $8.7 million after an attacker manipulated the illiquid MAMO token’s collateral price and borrowed real cbBTC against the inflated valuation.
On August 23, Term Finance lost approximately $8.5 million to a governance exploit in which an attacker bootstrapped voting control of USDC strategy vaults with 2 ETH sourced from Tornado Cash. On August 22, The Sandbox’s cross-chain SAND surface was hit for roughly $675,000 in extracted value via a LayerZero delegate abuse. All four incidents are chronicled in The Crypto Times’s rolling coverage of the week’s exploits.
Ajna is a smaller absolute loss than any of those, but it belongs in the same conversation for a different reason. Moonwell was a bad-oracle failure. Term Labs was a bad-voter-concentration failure. Sandbox was a delegate-configuration failure. Ajna, if the current onchain read holds, is a liquidation-accounting failure inside a system that was explicitly designed to have no oracle to fail, no governance to capture, and no delegate to configure wrong. Every core layer of the DeFi stack is now failing on its own terms, not on external inputs.
Coincidentally, on the same day Ajna disclosed its losses, the Fogo Foundation confirmed that an unknown actor had moved 400 million FOGO tokens, roughly 4% of total supply and about $3.9 million in market value, out of its wallets in an operational security failure unrelated to Ajna’s protocol-level exploit. The two incidents are unrelated in mechanism, but the calendar overlap adds to the sense that the last week of August has been unusually punishing for the sector.
Open Items
Several loose ends remain worth flagging for readers tracking this live.
- Full attacker address enumeration is partially obscured; Defimon’s three attacker links in its original thread route through t.co wrappers, and only partial addresses (0x80AD…, 0x6F2f…) are cleanly public at the time of writing.
- The published sample transaction covers the cbETH extraction only. Reconstructions on syrupUSDC, wstETH, rETH, WBTC, WETH/USDC, and sDAI have not yet been published at the same level of detail.
- Ajna has not published a formal postmortem, a patched-factory note, or an official loss table beyond acknowledging the incident and telling users to exit.
- Because Ajna v2 is immutable and ungoverned, there is no in-protocol mitigation path; recovery, if it happens, will need to come through offchain routes or attacker-return negotiation.
The larger question, one the team will eventually need to answer publicly, is whether the affected pools were legacy July 2023 v1 clones, as the current onchain read suggests, or whether any deployments through the January 2024 factory are exposed to the same code path. That distinction determines whether this is a bounded legacy-clone incident or the leading edge of a broader design conversation about Ajna’s liquidation math. Until an official postmortem lands, both readings are consistent with the available data.
Also Read: Solana Neobank Avici Hacked: Attacker Spends $190 to Drain $500K From 1,685 Users
