Ajna Finance confirms exploit, tells users to pull funds immediately
Security & Exploits ·
Protocol says liquidation accounting was manipulated to drain roughly $775,000; it is urging withdrawals and loan repayment while investigating.
Ajna v2 has confirmed an active exploit and instructed users to withdraw all funds, repay outstanding loans, and stop interacting with the protocol until the team completes its investigation, according to a statement posted on X by @ajnafi. Reporting on the incident puts the loss at roughly $775,000, tied to manipulation of the protocol's liquidation accounting logic.
The mechanism reportedly allowed an attacker to distort how liquidations were valued and settled, letting them extract funds beyond what the system's accounting should have permitted. Notably, the exploit proceeded despite an early warning: Defimon is said to have alerted the Ajna team roughly an hour before the first attack transaction went through, but the warning did not prevent the drain. On-chain activity tied to the incident can be traced through the attacker-linked address on Etherscan.
The episode fits a broader pattern of DeFi exploits that abuse legitimate-looking contract logic rather than obvious bugs, a category explained in general terms in Leviathan's explainer on exploits, which notes that vulnerabilities can sit undetected in code or design for months before someone finds a way to convert them into an economic attack. In Ajna's case, the target was the accounting layer governing liquidations rather than a bridge or token-minting function, distinguishing it from other recent incidents in the same period.
Multiple sources within the same cluster corroborate both the exploit and the protocol's response: one account confirms the $775,000 figure and the liquidation-accounting vector, while another separately confirms Ajna's advisory urging immediate withdrawal of all user funds. Together they describe a consistent sequence: detection, an ignored or too-late warning, exploitation, and a subsequent lockdown recommendation to affected users.
What remains unresolved is whether any funds can be recovered, whether the vulnerability has been patched, and what caused the apparent gap between Defimon's early alert and the team's ability to act on it before the attack executed. The protocol has not yet detailed a timeline for resuming normal operations or restoring the affected accounting logic.