{"investigation":{"slug":"merlin","entity_name":"Merlin DEX","trust_score":0,"severity_base":null,"score_modifier":-18,"confidence":0.88,"status":"under_investigation","content_type":"investigation","summary":"Merlin DEX was a decentralized exchange on zkSync Era that was drained of approximately $1.82 million in April 2023 during the liquidity generation event for its MAGE token. Security researchers and auditor CertiK concluded the incident was an insider rug pull by the protocol's own back-end developers, who held unlimited token approvals over all liquidity pools through a privileged feeTo address; the alleged perpetrators, reportedly based in Serbia, have not been publicly identified or prosecuted. CertiK pledged up to $2 million in compensation but froze only about $160,000 of the stolen funds, and the protocol has been defunct since. It is unrelated to Merlin Chain, a Bitcoin Layer 2 launched in 2024.","sections":[{"content":"On April 26, 2023, approximately $1.82 million in user funds, primarily USDC and WETH, was drained from Merlin DEX's liquidity pools within hours of the public launch of the Liquidity Generation Event (LGE) for its MAGE governance token on zkSync Era. One page dates the incident to April 26-27, 2023. The protocol had positioned the LGE as a safe entry point, telling users that pools would only go live after a completed CertiK security audit. The incident was initially characterized as an external hack but was subsequently classified as an insider rug pull executed by members of the project's own back-end development team, who held privileged access to the contracts through a 'feeTo' administrative address. PeckShield and other blockchain security monitors flagged the anomalous outflow in near-real time. Two attacker-controlled addresses reportedly withdrew roughly $850,000 and $844,000 USDC respectively; PeckShield analysis showed approximately $850,000 USDC bridged from zkSync to Ethereum mainnet, converted to ETH via PancakeSwap and routed through intermediate addresses, with $133,800 USDC sent to MEXC Global and $31,000 USDC to Binance. The primary attacker address identified was 0x2744d62a1e9ab975f4d77fe52e16206464ea79b7. The owner and feeTo addresses were altered after the exploit, allegedly in an attempt to obscure on-chain tracking.","heading":"Incident Overview: Insider Rug Pull","sources":[{"url":"https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit/","name":"CoinDesk: zkSync-Based DEX Merlin Drained of $1.8M During Public Token Sale Despite Audit","type":"news_article","credibility":1},{"url":"https://www.theblock.co/post/228302/zksync-dex-merlin-hack","name":"The Block: zkSync DEX Merlin reportedly hacked for $1.82 million immediately after code audit","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/","name":"CryptoSlate: CertiK says it highlighted centralization risks in Merlin DEX audit","type":"news_article","credibility":2},{"url":"https://decrypt.co/138023/rogue-developers-drain-merlin-dex-of-1-82-million","name":"Decrypt: Rogue Developers Drain Merlin DEX of $1.82 Million","type":"news_article","credibility":2},{"url":"https://unchainedcrypto.com/exploit-or-rug-pull-1-8-million-drained-from-zksync-dex-merlin-despite-audit/","name":"Unchained Crypto: Exploit or Rug Pull? $1.8 Million Drained From zkSync DEX Merlin Despite Audit","type":"news_article","credibility":2},{"url":"https://rekt.news/merlin-dex-rekt","name":"rekt.news: Merlin DEX - REKT","type":"news_article","credibility":3},{"url":"https://blockapex.io/merlin-dex-hack-analysis/","name":"BlockApex: Merlin DEX hack analysis","type":"research","credibility":3}],"severity":"critical"},{"content":"The exploit centered on the Factory Contract at 0x63E6fdAdb86Ea26f917496bEEEAEa4efb319229F. When liquidity pools were created, two lines of code in the MerlinSwapPair initialization function granted the feeTo address set by the pool creator (0xc0D6987d10430292A3ca994dd7A31E461eb28182), a developer-controlled wallet, unlimited token approval (type(uint256).max) over the token0 and token1 balances of every pool. The feeTo holder could therefore call transferFrom on any pool and withdraw all deposited assets without user consent. Rather than being locked behind multi-signature controls or on-chain governance, this privilege was controlled unilaterally by the back-end team, which used it to sweep the USDC-WETH pool and additional pools during the LGE window. Halborn identified the root cause as a violation of the principle of least privilege. BlockSec CEO Andy Zhou said the code contained 'obvious malicious logic' atypical of a standard DEX that should have been captured by auditors, and Verichains founder Thanh Nguyen concluded the backdoor was intentionally inserted rather than an accidental centralization risk, contradicting CertiK's initial framing of the issue as a private key management problem.","heading":"Technical Mechanism: The feeTo Backdoor","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023","name":"Halborn: Explained - The Merlin DEX Hack (April 2023)","type":"research","credibility":2},{"url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/","name":"DL News: Merlin heist highlights role of code auditor CertiK","type":"news_article","credibility":2},{"url":"https://www.certik.com/skynet-report/initialization-oversight-the-merlin-dex-exploit","name":"CertiK: Initialization Oversight - The Merlin DEX Exploit","type":"research","credibility":2},{"url":"https://www.bsc.news/post/certiks-audit-miss-2-lines-of-code-result-in-over-2m-rug-pull-on-zksync","name":"BSC News: CertiK Audit Miss - 2 Lines of Code Result in Over $2M Exploit on zkSync","type":"news_article","credibility":2},{"url":"https://blockapex.io/merlin-dex-hack-analysis/","name":"BlockApex: Merlin DEX hack analysis","type":"research","credibility":3},{"url":"https://cyvers.ai/blog/merlin-dex-hack-or-rug-pull-unraveling-the-1-8m-defi-heist-mystery","name":"Cyvers: Merlin DEX hack or rug pull? Unraveling the $1.8M DeFi heist mystery","type":"research","credibility":3}],"severity":"critical"},{"content":"Merlin's remaining team publicly attributed the theft to its back-end development contractors, described as developers based in Serbia who had been hired to build the protocol's core infrastructure; CertiK's investigation indicated the responsible parties were based in Europe. The team alleged the back-end group had previously worked on other crypto projects including Dynochain, Discoverilla and InterFi Network. Post-mortem research identified three GitHub accounts associated with the attack: pos-ninja (alias Haruto Y., whose profile was deleted after May 14, 2023), OneDev0411 (described as a full-stack engineer with over 7,000 GitHub contributions in 2022) and DotNetStar82 (a self-identified full-stack .NET and blockchain developer). A fourth account, sallamy2580, was flagged as using multiple aliases. Merlin said it had shared the developers' GitHub profiles with Serbian law enforcement and contacted CertiK to assist. CertiK said it submitted information to law enforcement agencies in the United States and the United Kingdom. According to CertiK's post-mortem, two of four core team members completed KYC verification while two refused all attempts to verify their identities, which impeded recovery and victim compensation. No arrests or prosecutions of named individuals have been publicly confirmed.","heading":"Alleged Perpetrators and Law Enforcement","sources":[{"url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md","name":"tayvano lazarus-bluenoroff research: merlin_dex.md","type":"research","credibility":2},{"url":"https://www.royalsblue.com/rug-pull-merlin-siphoned-off-by-its-back-end-developers/","name":"Royals Blue: Rug pull - Merlin siphoned off by its back-end developers","type":"news_article","credibility":3},{"url":"https://www.certik.com/resources/blog/6IWcuC1lSDQYQInmJXCloh-certiks-update-on-the-merlin-dex-rugpull","name":"CertiK: Update on the Merlin DEX Rugpull","type":"official","credibility":2},{"url":"https://decrypt.co/138023/rogue-developers-drain-merlin-dex-of-1-82-million","name":"Decrypt: Rogue Developers Drain Merlin DEX of $1.82 Million","type":"news_article","credibility":2},{"url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/","name":"Crypto.news: CertiK freezes $160k stolen in Merlin DEX insider rug pull","type":"news_article","credibility":2},{"url":"https://www.ibtimes.com/certik-denies-responsibility-issues-statement-after-drawing-flak-merlindex-rug-pull-3689910","name":"IBTimes: CertiK denies responsibility, issues statement after drawing flak over MerlinDEX rug pull","type":"news_article","credibility":3}],"severity":"critical"},{"content":"CertiK audited Merlin DEX shortly before the LGE. Reports differ on when the audit was completed: April 14, 2023 (about 12 days before the exploit) according to DL News, and April 24, 2023 according to an unsourced timeline entry on one of the merged pages. The audit received a Skynet security score of 90 out of 100. It noted 'centralization risks' under a section titled 'Decentralization Efforts', and CertiK says it recommended multi-signature wallets and on-chain governance; these recommendations were reportedly marked as resolved in the final report although the underlying issue remained unaddressed. The audit did not explicitly flag that the feeTo address held unlimited approval over all pool assets. CertiK's Skynet score for the project was downgraded from 90 to 38 after the incident. CertiK stated that 'private key privileges are outside the scope of a smart contract audit' while acknowledging it had not adequately emphasized the centralization risk to users. Director Hugh Brooks said CertiK employs approximately 150 human auditors and denied that the report was automatically generated; critics including Trading Strategy CEO Mikko Ohtamaa argued the methodology appeared automated. Prior post-audit incidents cited against CertiK include Arbix Finance ($10 million theft), Akropolis and Saddle Finance, and The Cryptonomist and other publications characterized CertiK as bearing some culpability for certifying a protocol containing an intentional backdoor.","heading":"CertiK Audit Failure and Controversy","sources":[{"url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/","name":"DL News: Merlin heist highlights role of code auditor CertiK","type":"news_article","credibility":2},{"url":"https://en.cryptonomist.ch/2023/05/09/certik-audit-firm-guilty-merlin-rug-pulling/","name":"The Cryptonomist: CertiK audit firm guilty of Merlin rug pulling","type":"news_article","credibility":2},{"url":"https://skynet.certik.com/projects/merlin-dex","name":"CertiK Skynet: Merlin DEX Project Insight","type":"official","credibility":2},{"url":"https://tokeninsight.com/en/news/merlin-exploited-after-certik-audit-raising-questions-about-audit-firm-s-validity","name":"TokenInsight: Merlin Exploited after CertiK Audit, Raising Questions about Audit Firm Validity","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/","name":"CryptoSlate: CertiK says it highlighted centralization risks in Merlin DEX audit","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull","name":"CoinDesk: DEX Merlin and CertiK Plan to Compensate $2M to Users Impacted in Rug Pull","type":"news_article","credibility":1},{"url":"https://www.theblock.co/post/228485/merlin-scam-certik-refund","name":"The Block: Crypto security firm vows refunds for Merlin DEX scam after auditing code","type":"news_article","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023","name":"Halborn: Explained - The Merlin DEX Hack (April 2023)","type":"research","credibility":2}],"severity":"high"},{"content":"On April 27, 2023, CertiK and the Merlin team announced a plan under which CertiK would commit up to $2 million to compensate affected users, described as the first time the firm had elected to pay restitution after a client defrauded investors. They also offered the alleged perpetrators a 20% white-hat bounty (one page puts it at approximately $360,000-$400,000) in exchange for returning 80% of the stolen funds; there is no public evidence the offer was accepted or that any funds were returned. On May 4, 2023, CertiK announced it had frozen $160,000 of the stolen assets with help from exchange partners, about 8.8% of the $1.82 million taken. The compensation effort was hampered because team members refused to verify their identities, which prevented victim validation and disbursement. No public confirmation that the full $2 million was disbursed has been identified. The protocol was effectively defunct after the incident, with no evidence of resumed operations or a successor product under the same brand.","heading":"Compensation and Fund Recovery","sources":[{"url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull","name":"CoinDesk: DEX Merlin and CertiK Plan to Compensate $2M to Users Impacted in Rug Pull","type":"news_article","credibility":1},{"url":"https://cryptoslate.com/certik-offers-merlin-dex-rogue-developers-20-white-hat-bounty/","name":"CryptoSlate: CertiK offers Merlin DEX rogue developers 20% white hat bounty","type":"news_article","credibility":2},{"url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/","name":"Crypto.news: CertiK freezes $160k stolen in Merlin DEX insider rug pull","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/228485/merlin-scam-certik-refund","name":"The Block: Crypto security firm vows refunds for Merlin DEX scam after auditing code","type":"news_article","credibility":2},{"url":"https://www.thecoinrepublic.com/2023/05/05/merlin-dex-rug-pull-160000-recovered-by-security-firm/","name":"The Coin Republic: Merlin DEX rug pull - $160,000 recovered by security firm","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/certik-and-zk-sync-dex-merlin-explore-2m-reimbursement-plan-for-rugpull-victims/","name":"CryptoPotato: CertiK and zkSync DEX Merlin explore $2M reimbursement plan for rug pull victims","type":"news_article","credibility":3}],"severity":"high"},{"content":"The Merlin DEX incident was one of the first major security incidents on zkSync Era mainnet after its March 2023 launch. It intensified scrutiny of smart contract audit firms, in particular the scope of audits and their limited ability to detect insider threats, and highlighted the distinction between code correctness, which can be audited, and privileged key management, which requires operational controls outside standard audit scope. Security researchers noted that marking the centralization risk as 'resolved' without verifiable on-chain mitigations was an audit methodology failure that contributed to user losses. On-chain investigator ZachXBT reportedly flagged Merlin DEX as part of broader monitoring of DeFi rug pulls and insider exploits, although no dedicated ZachXBT thread on Merlin has been publicly indexed; the incident is logged in community-maintained fraud research such as the tayvano lazarus-bluenoroff-research archive on GitHub. The case fits a recurring pattern: protocols launch on new Layer 2 networks where user due-diligence tools are immature, pass audits that miss intentional backdoors, accumulate liquidity quickly and are drained before remediation is possible.","heading":"Investigative Context and Industry Implications","sources":[{"url":"https://unchainedcrypto.com/exploit-or-rug-pull-1-8-million-drained-from-zksync-dex-merlin-despite-audit/","name":"Unchained Crypto: Exploit or Rug Pull? $1.8 Million Drained From zkSync DEX Merlin Despite Audit","type":"news_article","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023","name":"Halborn: Explained - The Merlin DEX Hack (April 2023)","type":"research","credibility":2},{"url":"https://blockapex.io/merlin-dex-hack-analysis/","name":"BlockApex: Merlin DEX hack analysis","type":"research","credibility":3},{"url":"https://cyvers.ai/blog/merlin-dex-hack-or-rug-pull-unraveling-the-1-8m-defi-heist-mystery","name":"Cyvers: Merlin DEX hack or rug pull? Unraveling the $1.8M DeFi heist mystery","type":"research","credibility":3},{"url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md","name":"tayvano lazarus-bluenoroff research: merlin_dex.md","type":"research","credibility":2},{"url":"https://x.com/zachxbt","name":"ZachXBT on X (Twitter)","type":"social_media","credibility":3}],"severity":"medium"},{"content":"Merlin DEX (zkSync Era, ticker MAGE, 2023) is unrelated to Merlin Chain, a Bitcoin Layer 2 network built by Bitmap Tech (formerly Recursiverse) that launched in 2024. Merlin Chain uses ZK-rollup technology and a decentralized oracle network to extend Bitcoin's programmability and has its own native token, MERL. MerlinSwap is a DEX within the Merlin Chain ecosystem and is separate from the defunct Merlin DEX on zkSync. Because of the shared branding, users should verify which entity is being referenced. This page concerns only Merlin DEX on zkSync Era.","heading":"Distinction from Merlin Chain (Bitcoin Layer 2)","sources":[{"url":"https://www.xverse.app/blog/merlin-chain","name":"Xverse: What Is Merlin Chain? A Guide to the Native Bitcoin Layer 2","type":"news_article","credibility":2},{"url":"https://merlinchain.io/","name":"Merlin Chain official website","type":"official","credibility":2},{"url":"https://www.okx.com/en-us/learn/what-is-merlin-chain","name":"OKX: What is Merlin Chain? Bitcoin Layer2, Features and Guide","type":"news_article","credibility":2}],"severity":"low"}],"timeline":[{"date":"2023-03","event":"zkSync Era mainnet launches; Merlin DEX begins development as an early native DEX on the network.","source":""},{"date":"2023-04","event":"CertiK completes its security audit of Merlin DEX (April 14 according to DL News; April 24 according to an unsourced entry on a merged page), awarding a Skynet score of 90/100. The audit notes centralization risks, reportedly marked as resolved, but does not flag the unlimited feeTo approval as a theft vector.","source":"DL News","source_url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/"},{"date":"2023-04","event":"On April 26, Merlin DEX launches the public MAGE token sale and liquidity generation event on zkSync Era. Within hours, rogue back-end developers use the feeTo approvals to drain approximately $1.82 million in USDC and WETH from the liquidity pools.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit/"},{"date":"2023-04","event":"PeckShield and other security monitors flag the outflow. About $850,000 USDC is bridged from zkSync to Ethereum and moved through PancakeSwap, with $133,800 USDC sent to MEXC Global and $31,000 USDC to Binance.","source":"CryptoSlate","source_url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/"},{"date":"2023-04","event":"CertiK issues an initial statement classifying the incident as a private key management issue (insider rug pull) rather than a smart contract exploit; the Merlin team issues a post-mortem blaming its back-end developer contractors.","source":"The Block","source_url":"https://www.theblock.co/post/228302/zksync-dex-merlin-hack"},{"date":"2023-04","event":"CertiK downgrades Merlin DEX's Skynet score from 90 to 38 following the incident.","source":"BSC News","source_url":"https://www.bsc.news/post/certiks-audit-miss-2-lines-of-code-result-in-over-2m-rug-pull-on-zksync"},{"date":"2023-04","event":"On April 27, CertiK and Merlin DEX announce a joint plan to compensate up to $2 million in user losses, and offer the rogue developers a 20% white-hat bounty to return 80% of the stolen funds.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull"},{"date":"2023-04","event":"Merlin's remaining team identifies its back-end contractors as Serbia-based developers and shares their GitHub profiles with Serbian authorities. GitHub accounts pos-ninja, OneDev0411, DotNetStar82 and sallamy2580 are flagged.","source":"tayvano on GitHub","source_url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"},{"date":"2023-05","event":"On May 4, CertiK announces it has frozen $160,000 of the stolen assets through partner exchanges. Two of four Merlin core team members continue to refuse identity verification, impeding victim compensation.","source":"Crypto.news","source_url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/"},{"date":"2023-05","event":"CertiK states it has submitted information to US and UK law enforcement agencies.","source":""},{"date":"2023-05","event":"Security research firms including Halborn and BlockApex publish technical post-mortems confirming the feeTo address permissions as the root cause.","source":"Halborn","source_url":"https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023"},{"date":"2023-05","event":"GitHub profile pos-ninja (Haruto Y.) is deleted after May 14, according to post-mortem research. The broader victim compensation plan remains unresolved.","source":"tayvano on GitHub","source_url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit/","name":"CoinDesk: zkSync-Based DEX Merlin Drained of $1.8M During Public Token Sale Despite Audit","type":"news_article","archive_url":"https://web.archive.org/web/20260724183733/https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit","credibility":1,"archive_timestamp":"2026-07-24T18:37:33+00:00"},{"url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull","name":"CoinDesk: DEX Merlin and CertiK Plan to Compensate $2M to Users Impacted in Rug Pull","type":"news_article","archive_url":"http://web.archive.org/web/20251010025002/https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull","credibility":1,"archive_timestamp":"2025-10-10T02:50:02+00:00"},{"url":"https://www.theblock.co/post/228302/zksync-dex-merlin-hack","name":"The Block: zkSync DEX Merlin reportedly hacked for $1.82 million immediately after code audit","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/228485/merlin-scam-certik-refund","name":"The Block: Crypto security firm vows refunds for Merlin DEX scam after auditing code","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://decrypt.co/138023/rogue-developers-drain-merlin-dex-of-1-82-million","name":"Decrypt: Rogue Developers Drain Merlin DEX of $1.82 Million","type":"news_article","archive_url":"http://web.archive.org/web/20260116193915/https://decrypt.co/138023/rogue-developers-drain-merlin-dex-of-1-82-million","credibility":2,"archive_timestamp":"2026-01-16T19:39:15+00:00"},{"url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/","name":"DL News: Merlin heist highlights role of code auditor CertiK","type":"news_article","archive_url":"http://web.archive.org/web/20260617150136/https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/","credibility":2,"archive_timestamp":"2026-06-17T15:01:36+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023","name":"Halborn: Explained - The Merlin DEX Hack (April 2023)","type":"research","archive_url":"http://web.archive.org/web/20260415074328/https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023","credibility":2,"archive_timestamp":"2026-04-15T07:43:28+00:00"},{"url":"https://cryptoslate.com/certik-offers-merlin-dex-rogue-developers-20-white-hat-bounty/","name":"CryptoSlate: CertiK offers Merlin DEX rogue developers 20% white hat bounty","type":"news_article","archive_url":"http://web.archive.org/web/20260313140536/https://cryptoslate.com/certik-offers-merlin-dex-rogue-developers-20-white-hat-bounty/","credibility":2,"archive_timestamp":"2026-03-13T14:05:36+00:00"},{"url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/","name":"CryptoSlate: CertiK says it highlighted centralization risks in Merlin DEX audit","type":"news_article","archive_url":"http://web.archive.org/web/20260310215119/https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/","credibility":2,"archive_timestamp":"2026-03-10T21:51:19+00:00"},{"url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/","name":"Crypto.news: CertiK freezes $160k stolen in Merlin DEX insider rug pull","type":"news_article","archive_url":"https://web.archive.org/web/20260724175341/https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/","credibility":2,"archive_timestamp":"2026-07-24T17:53:41+00:00"},{"url":"https://www.certik.com/resources/blog/6IWcuC1lSDQYQInmJXCloh-certiks-update-on-the-merlin-dex-rugpull","name":"CertiK: Update on the Merlin DEX Rugpull","type":"official","archive_url":"https://web.archive.org/web/20260725085608/https://www.certik.com/blog/6IWcuC1lSDQYQInmJXCloh-certiks-update-on-the-merlin-dex-rugpull","credibility":2,"archive_timestamp":"2026-07-25T08:56:08+00:00"},{"url":"https://skynet.certik.com/projects/merlin-dex","name":"CertiK Skynet: Merlin DEX Project Insight","type":"official","archive_url":"https://web.archive.org/web/20260724212809/https://skynet.certik.com/projects/merlin-dex","credibility":2,"archive_timestamp":"2026-07-24T21:28:09+00:00"},{"url":"https://www.certik.com/skynet-report/initialization-oversight-the-merlin-dex-exploit","name":"CertiK: Initialization Oversight - The Merlin DEX Exploit","type":"research","archive_url":"https://web.archive.org/web/20260725040323/https://www.certik.com/blog/initialization-oversight-the-merlin-dex-exploit","credibility":2,"archive_timestamp":"2026-07-25T04:03:23+00:00"},{"url":"https://www.bsc.news/post/certiks-audit-miss-2-lines-of-code-result-in-over-2m-rug-pull-on-zksync","name":"BSC News: CertiK Audit Miss - 2 Lines of Code Result in Over $2M Exploit on zkSync","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://en.cryptonomist.ch/2023/05/09/certik-audit-firm-guilty-merlin-rug-pulling/","name":"The Cryptonomist: CertiK audit firm guilty of Merlin rug pulling","type":"news_article","archive_url":"http://web.archive.org/web/20260216203813/https://en.cryptonomist.ch/2023/05/09/certik-audit-firm-guilty-merlin-rug-pulling/","credibility":2,"archive_timestamp":"2026-02-16T20:38:13+00:00"},{"url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md","name":"tayvano lazarus-bluenoroff research: merlin_dex.md","type":"research","archive_url":"http://web.archive.org/web/20260404044148/https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md","credibility":2,"archive_timestamp":"2026-04-04T04:41:48+00:00"},{"url":"https://unchainedcrypto.com/exploit-or-rug-pull-1-8-million-drained-from-zksync-dex-merlin-despite-audit/","name":"Unchained Crypto: Exploit or Rug Pull? $1.8 Million Drained From zkSync DEX Merlin Despite Audit","type":"news_article","archive_url":"https://web.archive.org/web/20260829184821/https://unchainedcrypto.com/exploit-or-rug-pull-1-8-million-drained-from-zksync-dex-merlin-despite-audit/","credibility":2,"archive_timestamp":"2026-08-29T18:48:21+00:00"},{"url":"https://www.thecoinrepublic.com/2023/05/05/merlin-dex-rug-pull-160000-recovered-by-security-firm/","name":"The Coin Republic: Merlin DEX rug pull - $160,000 recovered by security firm","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:unauthorized","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://tokeninsight.com/en/news/merlin-exploited-after-certik-audit-raising-questions-about-audit-firm-s-validity","name":"TokenInsight: Merlin Exploited after CertiK Audit, Raising Questions about Audit Firm Validity","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.xverse.app/blog/merlin-chain","name":"Xverse: What Is Merlin Chain? A Guide to the Native Bitcoin Layer 2","type":"news_article","archive_url":"http://web.archive.org/web/20260311214923/https://www.xverse.app/blog/merlin-chain","credibility":2,"archive_timestamp":"2026-03-11T21:49:23+00:00"},{"url":"https://www.royalsblue.com/rug-pull-merlin-siphoned-off-by-its-back-end-developers/","name":"Royals Blue: Rug pull - Merlin siphoned off by its back-end developers","type":"news_article","archive_url":"http://web.archive.org/web/20260608021434/https://www.royalsblue.com/rug-pull-merlin-siphoned-off-by-its-back-end-developers/","credibility":3,"archive_timestamp":"2026-06-08T02:14:34+00:00"},{"url":"https://x.com/zachxbt","name":"ZachXBT on X (Twitter)","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://merlinchain.io/","name":"Merlin Chain official website","type":"official","archive_url":"http://web.archive.org/web/20261007041704/https://merlinchain.io/","credibility":2,"archive_timestamp":"2026-10-07T04:17:04+00:00"},{"url":"https://www.okx.com/en-us/learn/what-is-merlin-chain","name":"OKX: What is Merlin Chain? Bitcoin Layer2, Features and Guide","type":"news_article","archive_url":"http://web.archive.org/web/20261007041724/https://www.okx.com/en-us/learn/what-is-merlin-chain","credibility":2,"archive_timestamp":"2026-10-07T04:17:24+00:00"},{"url":"https://rekt.news/merlin-dex-rekt","name":"rekt.news: Merlin DEX - REKT","type":"news_article","archive_url":"http://web.archive.org/web/20260513171617/https://rekt.news/merlin-dex-rekt","credibility":3,"archive_timestamp":"2026-05-13T17:16:17+00:00"},{"url":"https://blockapex.io/merlin-dex-hack-analysis/","name":"BlockApex: Merlin DEX hack analysis","type":"research","archive_url":"http://web.archive.org/web/20260510141706/https://blockapex.io/merlin-dex-hack-analysis/","credibility":3,"archive_timestamp":"2026-05-10T14:17:06+00:00"},{"url":"https://cyvers.ai/blog/merlin-dex-hack-or-rug-pull-unraveling-the-1-8m-defi-heist-mystery","name":"Cyvers: Merlin DEX hack or rug pull? Unraveling the $1.8M DeFi heist mystery","type":"research","archive_url":"http://web.archive.org/web/20260207190859/https://cyvers.ai/blog/merlin-dex-hack-or-rug-pull-unraveling-the-1-8m-defi-heist-mystery","credibility":3,"archive_timestamp":"2026-02-07T19:08:59+00:00"},{"url":"https://www.ibtimes.com/certik-denies-responsibility-issues-statement-after-drawing-flak-merlindex-rug-pull-3689910","name":"IBTimes: CertiK denies responsibility, issues statement after drawing flak over MerlinDEX rug pull","type":"news_article","archive_url":"https://web.archive.org/web/20260830005436/https://www.ibtimes.com/certik-denies-responsibility-issues-statement-after-drawing-flak-merlindex-rug-pull-3689910","credibility":3,"archive_timestamp":"2026-08-30T00:54:36+00:00"},{"url":"https://cryptopotato.com/certik-and-zk-sync-dex-merlin-explore-2m-reimbursement-plan-for-rugpull-victims/","name":"CryptoPotato: CertiK and zkSync DEX Merlin explore $2M reimbursement plan for rug pull victims","type":"news_article","archive_url":"http://web.archive.org/web/20260216080136/https://cryptopotato.com/certik-and-zk-sync-dex-merlin-explore-2m-reimbursement-plan-for-rugpull-victims/","credibility":3,"archive_timestamp":"2026-02-16T08:01:36+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-05-04T02:54:57.055816+00:00","updated_at":"2026-11-02T04:44:55.816+00:00"},"source_quality":{"total":29,"tier1":0,"tier2":10,"tier3":1,"unrated":18},"follower_count":null,"content_updated_at":"2026-11-02T04:44:56.764Z","last_fact_checked_at":"2026-11-02T04:44:56.198Z","fact_check_next_allowed_at":"2026-11-09T04:44:56.198Z","update_next_allowed_at":null}