Ajna Exploit: $775,400 Drained and No Pause Button in the DeFi Lending Protocol

If you have funds sitting in the DeFi lending protocol Ajna v2, withdraw them now. The development team itself called for exactly that on August 29, 2026 at 04:58 UTC: withdraw all quote tokens, repay outstanding loans and stop every further interaction with the protocol. Between August 28 and 29, roughly $775,400 drained out of seven pools on the Ethereum blockchain. Measured by the sum, this is a small incident. Measured by what it reveals about a particular way of building DeFi protocols, it is among the most instructive of this summer. The reason lies in the construction. Ajna v2 is built to be immutable: no governance body, no upgrade path, no administrator key that could halt the contract. A security update while the protocol runs is therefore technically ruled out. The only party that can stop the outflow is the users, by taking their capital out. The team's call is consequently not one precaution among others. It is the only available response. The Ajna exploit at a glance: $775,400 from seven Ethereum pools A DeFi lending protocol is a set of smart contracts through which users can lend crypto assets and borrow against posted collateral, with no bank or company in between. At Ajna the lent capital sits in pools, each of which brings together one collateral asset and one loan asset. The security firm Defimon published a per-pool breakdown on August 29 at 09:29 UTC. According to it, the damage is distributed as follows: the syrupUSDC pool lost the most at around $173,700, followed by wstETH at about $159,800 and rETH at roughly $143,000 in total across two transactions. cbETH accounted for around $136,900, likewise in two steps, the WBTC pool for around $101,800, WETH/USDC for around $42,000 and sDAI for around $18,000. Together that produces the $775,400 mentioned above. The outlet Cryptopolitan, citing DefiLlama, gives a slightly different figure of around $775,000; the difference lies in how the affected tokens are priced and is immaterial for the assessment. The timeline is tight. On August 28 at 15:16 UTC the attack contracts were deployed on Ethereum. A good hour later, at 16:19 UTC, the first extraction ran through the cbETH pool, recorded in block 25854888. The team's public statement did not follow until the next morning. In the meantime the outflow continued. That leaves marks on the size of the protocol. Total value locked, meaning the sum of all assets deposited in the protocol, stood at about $246,880 after the incident. Over the preceding thirty days that amounts to a decline of 71.3 percent. Ajna was already a small protocol before the attack. Now it is a very small one.